Buffer Underwrite ('Buffer Underflow') in FortiProxy and FortiOS - CVE-2023-25610
Published: March 9, 2023 / Updated: June 26, 2023
Vulnerability identifier: #VU73200
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-25610
CWE-ID: CWE-124
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected device.
The vulnerability exists due to a heap buffer underflow in the administrative interface. A remote non-authenticated attacker can send a specially crafted request to the administrative web interface of the affected device, trigger memory corruption and execute arbitrary code on the system.
Affected software
FortiProxy
RUGGEDCOM APE1808
FortiOS
RUGGEDCOM APE1808
FortiOS
How to mitigate CVE-2023-25610
Install updates from vendor's website.
FortiProxy - addressed in versions 2.0.12, 7.0.9, 7.2.3
FortiOS - addressed in versions 6.2.13, 6.4.12, 7.0.10, 7.2.4
FortiOS - addressed in versions 6.2.13, 6.4.12, 7.0.10, 7.2.4