CVE-2023-42789 | FortiOS - Firewall Operational Intel

Executive Risk Summary

"A critical vulnerability in Fortinet FortiOS allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests, potentially leading to a complete system compromise. This vulnerability affects multiple versions of FortiOS, including 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, and 6.2.0 through 6.2.15."

Operational Audit Arsenal

Target Type Firmware Image

Target Asset FortiOS

Standard Path Global Firmware

Manual Verification Required

This is a non-Windows asset (Fortinet). Use the target asset details above to verify your version against vendor advisories.

Patch Impact Forecast

Reboot Required Likely

High

Internal Work Notes

Urgent patching required for FortiOS due to critical vulnerability allowing remote code execution via HTTP requests.

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://fortiguard.com/psirt/FG-IR-23-328

Scope of Impact

Fortinet Fortios (Version 7.4.0)Fortinet FortiproxyFortinet FortiosFortinet Fortiproxy (Version 7.4.0)Fortinet Fortios (Version 7.4.1)

Original NVD Description

"A out-of-bounds write in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests."

Related Fortinet Threats

CVE-2024-23108 CVSS 10

FortiGate - API

CVE-2024-23109 CVSS 10

FortiGate - API

CVE-2023-34992 CVSS 10

FortiGate - API

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.