CVE-2023-45583

MediumCVSS 6.7

Published: 14/05/2024(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.66%

51th percentile - higher than 51% of all known CVEs

Summary

A use of externally-controlled format string vulnerability exists in multiple Fortinet products (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager). An attacker can execute unauthorized code or commands via specially crafted CLI commands and HTTP requests.

Risk Assessment

Remote code or command execution on the organization's edge devices may lead to compromise of network infrastructure.

Recommendation

Update the listed Fortinet products to the latest patched versions and restrict access to administrative interfaces.

Other vulnerabilities in Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager

CVE-2024-26010High
A stack-based buffer overflow vulnerability in multiple Fortinet products (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) allows an attacker to execute unauthorized code or commands via specially crafted packets.

Original NVD description (English source)

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiSwitchManager 7.2.0 through 7.2.2, FortiSwitchManager 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS