CVE-2023-25610

The vulnerability lies in improper buffer boundary handling in the administrative layer, where a crafted network request causes data to be written below the start of the reserved memory area (buffer underflow, CWE-124). The attacker sends specially constructed HTTP/HTTPS requests to the device's management interface without needing any credentials. Improper memory overwrite can lead to hijacking control of the process execution flow and running arbitrary code with the process's privileges.

An attacker can remotely execute arbitrary code or system commands on a vulnerable device without authentication, which in practice means complete takeover of the network device (firewall, proxy, switch manager) and potential lateral movement within the organization's network.

Patches available from the vendor must be applied immediately according to references (https://fortiguard.com/psirt/FG-IR-23-001). As a mitigation measure, if immediate update is not possible, access to the administrative interface should be restricted to trusted hosts and management networks only, and access from the Internet to administrative ports on all vulnerable devices should be blocked.

FortiOS 7.2.0–7.2.3, 7.0.0–7.0.6, 6.4.0–6.4.11, 6.2.12 and earlier; FortiProxy 7.2.0–7.2.2, 7.0.0–7.0.8, 2.0.12 and earlier; FortiOS-6K7K 7.0.5, 6.4.0–6.4.10, 6.2.0–6.2.10 and earlier; products from FortiSwitch, FortiSwitchManager and FortiManager lines (versions indicated in vendor references)