Fortinet Warns of Critical Unauthenticated RCE Vulnerability
March 8, 2023
Fortinet has disclosed a critical vulnerability impacting FortiOS and FortiProxy, tracked as CVE-2023-25610, which allows an unauthenticated attacker to execute arbitrary code or perform denial of service (DoS) on the GUI of vulnerable devices. This buffer underflow vulnerability has a CVSS v3 score of 9.3, rating it critical. Fifty device models are not impacted by the arbitrary code execution component of the flaw, but only the denial of service part. Fortinet suggests disabling the HTTP/HTTPS administrative interface or limiting the IP addresses that can access it remotely as a workaround. It is imperative to mitigate this vulnerability quickly, as threat actors keep an eye for critical-severity flaws impacting Fortinet products. On February 16, Fortinet fixed two critical remote code execution flaws impacting FortiNAC and FortiWeb products, and a working proof-of-concept exploit was made public only four days later. Active exploitation in the wild began on February 22, 2023.
Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.
By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.
Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.