CVE-2023-25610

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25610
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fortiguard.com/psirt/FG-IR-23-001 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:a:fortinet:fortios-6k7k:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortios-6k7k:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortios-6k7k:7.0.5:*:*:*:*:*:*:*

Configuration 6 (hide)

OR cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

Configuration 7 (hide)

OR cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*

Configuration 8 (hide)

OR cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*
History

24 Jul 2025, 19:56

Type Values Removed Values Added
CPE cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortios-6k7k:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortiswitch:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortios-6k7k:7.0.5:*:*:*:*:*:*:*
References () https://fortiguard.com/psirt/FG-IR-23-001 - () https://fortiguard.com/psirt/FG-IR-23-001 - Vendor Advisory
First Time Fortinet fortios
Fortinet fortiswitchmanager
Fortinet fortiswitch
Fortinet fortiweb
Fortinet fortianalyzer
Fortinet fortimanager
Fortinet fortios-6k7k
Fortinet fortiproxy
Fortinet

27 Mar 2025, 16:44

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de suscripción de búfer ('desbordamiento de búfer') en la interfaz administrativa de Fortinet FortiOS versión 7.2.0 a 7.2.3, versión 7.0.0 a 7.0.6, versión 6.4.0 a 6.4.11 y versión 6.2.12 y anteriores, FortiProxy versión 7.2.0 a 7.2.2, versión 7.0.0 a 7.0.8, versión 2.0.12 y anteriores y FortiOS-6K7K versión 7.0.5, versión 6.4.0 a 6.4.10 y versión 6.2.0 a 6.2.10 y anteriores permite a un atacante remoto no autenticado ejecutar código o comandos arbitrarios a través de solicitudes específicamente manipuladas.

24 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-24 16:15

Updated : 2025-07-24 19:56

NVD link : CVE-2023-25610

Mitre link : CVE-2023-25610

CVE.ORG link : CVE-2023-25610

JSON object : View

Products Affected

fortinet

  • fortianalyzer
  • fortios
  • fortiswitchmanager
  • fortiproxy
  • fortimanager
  • fortios-6k7k
  • fortiswitch
  • fortiweb
CWE
CWE-124

Buffer Underwrite ('Buffer Underflow')