FortiOS/FortiProxy 7.x Admin Interface Buffer Underwrite (CVE-2023-25610)
CVE-2023-25610 Published on March 24, 2025

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

NVD

Vulnerability Analysis

CVE-2023-25610 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a buffer underrun Vulnerability?

The software writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer. This typically occurs when a pointer or its index is decremented to a position before the buffer, when pointer arithmetic results in a position before the beginning of the valid memory location, or when a negative index is used.

CVE-2023-25610 has been classified to as a buffer underrun vulnerability or weakness.


Products Associated with CVE-2023-25610

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-25610 are published in these products:

Fortinet FortiOS
 
Fortinet FortiWeb
 
Fortinet Fortiswitchmanager
 
Fortinet Fortiswitch
 
Fortinet FortiProxy
 
Fortinet Fortios 6k7k
 
Fortinet FortiManager
 
Fortinet Fortianalyzer
 

Affected Versions

Fortinet FortiSwitchManager: Fortinet FortiAnalyzer: Fortinet FortiOS-6K7K: Fortinet FortiProxy: Fortinet FortiOS: Fortinet FortiManager: Fortinet FortiWeb:

Exploit Probability

EPSS
25.02%
Percentile
96.04%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.