CVE-2023-36640
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Fortinet FortiOS, FortiPAM, and FortiProxy in the listed versions contain a use of externally-controlled format string vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted commands. The vulnerability affects multiple versions of FortiOS (7.4.0, 7.2.0-7.2.5, 7.0, 6.4, 6.2, 6.0.0-6.0.16), FortiPAM (1.1.0, 1.0), and FortiProxy (7.2.0-7.2.5, 7.0.0-7.0.11, 2.0, 1.2, 1.1, and others).
Risk Assessment
An attacker can execute unauthorized code or commands, potentially leading to compromise of the network device and further escalation within the network. This poses a serious threat to infrastructure security.
Recommendation
Update FortiOS, FortiPAM, and FortiProxy to the latest versions containing the fix. Verify the Fortinet security advisory and apply the appropriate updates.
Other vulnerabilities in Fortinet FortiOS/FortiPAM/FortiProxy
See all- CVE-2026-84392Low
A NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiOS, FortiPAM and FortiProxy. An authenticated attacker can send crafted HTTP requests to crash the httpsd daemon.
- CVE-2025-54821Low
An improper privilege management vulnerability (CWE-269) exists in Fortinet FortiOS, FortiPAM, and FortiProxy. An authenticated administrator may bypass the trusted host policy via a crafted CLI command.
- CVE-2023-29181High
A use of externally-controlled format string vulnerability in Fortinet FortiOS, FortiPAM, and FortiProxy allows an attacker to execute unauthorized code or commands via a specially crafted command.
Original NVD description (English source)
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
Vulnerability data from NVD (NIST) · CISA KEV · EPSS