CVE-2023-23783
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Fortinet FortiWeb versions 7.0.0 through 7.0.1 and FortiWeb 6.4 all versions contain a use of externally-controlled format string vulnerability allowing an attacker to execute unauthorized code or commands via specially crafted command arguments.
Risk Assessment
An attacker could execute arbitrary code or commands on the system, potentially leading to full device compromise. This may affect confidentiality, integrity, and availability.
Recommendation
Update FortiWeb to a version containing the vendor fix. Until then, restrict access to the management interface.
Other vulnerabilities in Fortinet FortiWeb
See all- CVE-2016-4066High
CVE-2016-4066 is a CSRF vulnerability in Fortinet FortiWeb before version 5.5.3 that allows remote attackers to hijack the authentication of administrators for password change requests via unspecified vectors.
- CVE-2025-64446CriticalActively exploited
A relative path traversal vulnerability in Fortinet FortiWeb versions 8.0.0-8.0.1, 7.6.0-7.6.4, 7.4.0-7.4.9, 7.2.0-7.2.11, and 7.0.0-7.0.11 may allow an attacker to execute administrative commands via crafted HTTP or HTTPS requests.
- CVE-2026-39811Medium
An integer overflow or wraparound vulnerability in Fortinet FortiWeb versions 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, 7.4, 7.2, and 7.0 may allow an attacker to cause a denial of service.
Original NVD description (English source)
A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS