CVE-2023-25610: fortios — Fix

Description

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Is your site exposed to CVE-2023-25610?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-124 CWE-124

Affected Products

Vendor	Product	Versions
fortinet	fortiweb	6.1.0 — 6.1.4
fortinet	fortiweb	6.2.0 — 6.2.8
fortinet	fortiweb	6.3.0 — 6.3.23
fortinet	fortiweb	6.4.0 — 6.4.3
fortinet	fortiweb	7.0.0 — 7.0.7
fortinet	fortiweb	7.2.0 — 7.2.2
fortinet	fortiswitchmanager	7.0.0 — 7.0.2
fortinet	fortiswitchmanager	7.2.0 — 7.2.2
fortinet	fortiswitch	7.0.0 — 7.0.7
fortinet	fortiswitch	7.2.0 — 7.2.4
fortinet	fortiproxy	1.1.0 — 7.0.9
fortinet	fortiproxy	7.2.0 — 7.2.3
fortinet	fortios-6k7k	6.0.4 — 6.2.13
fortinet	fortios-6k7k	6.4.2 — 6.4.12
fortinet	fortios-6k7k	All
fortinet	fortios	5.0.0 — 6.2.13
fortinet	fortios	6.4.0 — 6.4.12
fortinet	fortios	7.0.0 — 7.0.10
fortinet	fortios	7.2.0 — 7.2.4
fortinet	fortimanager	6.0.0 — 6.0.12
fortinet	fortimanager	6.2.0 — 6.2.11
fortinet	fortimanager	6.4.0 — 6.4.12
fortinet	fortimanager	7.0.0 — 7.0.5
fortinet	fortimanager	All
fortinet	fortianalyzer	6.0.0 — 6.0.12
fortinet	fortianalyzer	6.2.0 — 6.2.11
fortinet	fortianalyzer	6.4.0 — 6.4.12
fortinet	fortianalyzer	7.0.0 — 7.0.5
fortinet	fortianalyzer	All

References

Advisories & Patches

https://fortiguard.com/psirt/FG-IR-23-001

Frequently Asked Questions

What is CVE-2023-25610? +

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2023-25610? +

CVE-2023-25610 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2023-25610? +

CVE-2023-25610 affects products from fortinet, specifically: fortianalyzer, fortimanager, fortios, fortios-6k7k, fortiproxy, fortiswitch, fortiswitchmanager, fortiweb. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2023-25610? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-16439

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.

CVE-2024-36343

Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out …

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked …

CVE-2026-44631 9.8

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: …

CVE-2025-27440 8.5

Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network …

CVE-2025-27439 8.5

Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network …

CVE-2023-25610