However, these same models are still vulnerable to the denial-of-service part, even if they are running a vulnerable version of FortiOS. (Multiple Vulnerabilities in Fortinet Products Could Allow for Arbitrary Code 2023)Īccording to Fortinet’s security bulletin, there are fifty device models that are not affected by the arbitrary code execution aspect of the vulnerability. Fortinet’s telemetry data revealed no evidence that threat actors exploited the vulnerability in real-world attacks. This leads to accessing adjacent memory locations, potentially resulting in unstable behavior or system crashes. A buffer underflow vulnerability like this occurs when a program attempts to read more data from a memory buffer than is available. The vulnerability is recognized as CVE-2023-25610 and has obtained a CVSS v3 score of 9.3, which is classified as critical. This flaw permits an attacker who has not been authenticated to run arbitrary code or conduct a denial-of-service (DoS) attack on the graphical user interface (GUI) of the affected systems by employing specially designed requests. Background Informationįortinet has recently revealed a highly severe vulnerability, marked as “Critical,” that affects both FortiOS and FortiProxy.

These products are designed to provide network security solutions that offer protection from constantly emerging threats to your network, data, and users.

Multiple vulnerabilities have recently been identified in Fortinet products.