PT-2023-27610 · Fortinet · Fortitester

Published 2023-12-12 · Updated 2023-12-15 · CVE-2023-40716

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiTester versions 2.3.0 through 7.2.3

Description An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup.

Recommendations For FortiTester versions 2.3.0 through 7.2.3, consider disabling the execute restore/backup functionality until a patch is available to prevent exploitation. Restrict access to the command line interpreter to minimize the risk of unauthorized command execution. Avoid using specifically crafted arguments when running execute restore/backup until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-40716

Affected Products

Fortitester

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-40716 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-345 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40716 · Vendor Advisory
• https://t.me/cvenotify/63444 · Telegram Post
• https://t.me/cvenotify/63804 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734902112633426310 · Twitter Post
• https://t.me/cvenotify/63406 · Telegram Post
• https://twitter.com/CVEnew/status/1734828594633867330 · Twitter Post