FortiOS SSL VPN MemCorrupt (v7.4.0 & 7.2.0-7.2.5) CVE-2023-37930
CVE-2023-37930 Published on April 8, 2025
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.
Vulnerability Analysis
CVE-2023-37930 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Products Associated with CVE-2023-37930
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-37930 are published in these products:
Affected Versions
Fortinet FortiProxy:- Version 7.2.0, <= 7.2.6 is affected.
- Version 7.0.0, <= 7.0.12 is affected.
- Version 7.4.0 is affected.
- Version 7.2.0, <= 7.2.5 is affected.
- Version 7.0.1, <= 7.0.11 is affected.
- Version 6.4.7, <= 6.4.14 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.