CVE-2023-33308
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk77th percentile - higher than 77% of all known CVEs
Summary
A stack-based overflow vulnerability exists in Fortinet FortiOS (versions 7.0.0 to 7.0.10 and 7.2.0 to 7.2.3) and FortiProxy (versions 7.0.0 to 7.0.9 and 7.2.0 to 7.2.2) that allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.
Risk Assessment
This vulnerability poses a significant risk to organizations, allowing attackers to remotely take control of the system. This could lead to data loss, integrity breaches, and potential financial losses.
Recommendation
It is recommended to immediately update FortiOS and FortiProxy to the latest versions that address this vulnerability. Additionally, consider implementing further security measures such as monitoring network traffic.
Original NVD description (English source)
A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.