Vulnerability Description
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortios | >= 6.2.0, < 7.0.14 |
| Fortinet | Fortiswitchmanager | >= 7.0.0, < 7.0.3 |
| Fortinet | Fortiproxy | >= 1.2.0, < 7.0.15 |
| Fortinet | Fortipam | >= 1.0.0, < 1.2.0 |
Related Weaknesses (CWE)
References
- https://fortiguard.com/psirt/FG-IR-23-261Vendor Advisory
FAQ
What is CVE-2023-40721?
CVE-2023-40721 is a vulnerability with a CVSS score of 6.7 (MEDIUM). A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.
How severe is CVE-2023-40721?
CVE-2023-40721 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-40721?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortios, Fortinet Fortiswitchmanager, Fortinet Fortiproxy, Fortinet Fortipam.