A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Fortinet Fortianalyzer | — | Upgrade FortiAnalyzer to 6.4.12Upgrade FortiAnalyzer to 6.2.11Upgrade FortiAnalyzer to 6.0.12Upgrade FortiAnalyzer to 7.2.1Upgrade FortiAnalyzer to 7.0.5 | Apr 7, 2026 | Mar 7, 2023 |
| Fortinet Fortimanager | — | Upgrade FortiManager to 6.4.12Upgrade FortiManager to 7.2.1Upgrade FortiManager to 7.0.5Upgrade FortiManager to 6.0.12Upgrade FortiManager to 6.2.11 | May 25, 2026 | Mar 7, 2023 |
| Fortinet Fortiproxy | — | — | Sep 30, 2026 | Mar 7, 2023 |
| Fortinet Fortiswitchmanager | — | — | Sep 30, 2026 | Mar 7, 2023 |
| Fortinet Fortiweb | — | Upgrade FortiWeb to 6.1.4Upgrade FortiWeb to 7.2.2Upgrade FortiWeb to 7.0.7Upgrade FortiWeb to 6.4.3Upgrade FortiWeb to 6.3.23Upgrade FortiWeb to 6.2.8 | Jul 2, 2026 | Mar 7, 2023 |
| Fortios | — | Upgrade FortiOS to 7.2.4Upgrade to the latest version of FortiOSUpgrade FortiOS to 7.0.10Upgrade FortiOS to 6.2.13Upgrade FortiOS to 6.4.12 | Apr 21, 2023 | Mar 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub