CVE-2023-36641
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
A numeric truncation error vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to cause a denial of service via specifically crafted HTTP requests.
Risk Assessment
This may cause service unavailability on Fortinet devices, affecting network continuity.
Recommendation
Update FortiOS and FortiProxy to patched versions.
Other vulnerabilities in Fortinet FortiOS/FortiProxy
See all- CVE-2018-13382CriticalActively exploited
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests.
- CVE-2018-13379CriticalActively exploited
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
- CVE-2023-41677High
A insufficiently protected credentials vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via a targeted social engineering attack.
- CVE-2023-29180High
A null pointer dereference vulnerability in Fortinet FortiOS and FortiProxy across multiple versions allows an attacker to cause a denial of service via specially crafted HTTP requests.
- CVE-2023-33307Medium
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
- CVE-2023-29178Medium
An access of uninitialized pointer vulnerability (CWE-824) in Fortinet FortiOS and FortiProxy allows an authenticated attacker to repeatedly crash the httpsd process via crafted HTTP or HTTPS requests.
Original NVD description (English source)
A numeric truncation error vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy 7.2.0 through 7.2.4, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to denial of service via specifically crafted HTTP requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS