CVE-2023-33308

CRITICAL

9.8

Description

A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/26/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

fortinet:fortiosfortinet:fortiproxy

Weaknesses (CWE)

CWE-121CWE-787

References

https://fortiguard.com/psirt/FG-IR-23-183(psirt@fortinet.com)

https://fortiguard.com/psirt/FG-IR-23-183(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.