CVE-2023-36640
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability in Fortinet FortiOS and FortiProxy allows for the use of externally-controlled format strings, enabling an attacker to execute unauthorized code or commands via specially crafted commands.
Risk Assessment
This vulnerability could lead to serious security breaches, allowing attackers to gain control over the system and perform arbitrary actions within its context.
Recommendation
It is recommended to update to the latest version of FortiOS and FortiProxy to mitigate this vulnerability and to monitor systems for unauthorized activities.
Original NVD description (English source)
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands