PT-2023-3490 · Fortinet · Fortios+1

Published

2023-07-11

·

Updated

2026-04-21

·

CVE-2023-33308

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0 through 7.0.10 FortiOS versions 7.2.0 through 7.2.3 FortiProxy versions 7.0.0 through 7.0.9 FortiProxy versions 7.2.0 through 7.2.2
Description A stack-based overflow vulnerability in Fortinet FortiOS and FortiProxy allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection. The vulnerability can be exploited by sending specially crafted SSL packets.
Recommendations For FortiOS versions 7.0.0 through 7.0.10, disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode. For FortiOS versions 7.2.0 through 7.2.3, disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode. For FortiProxy versions 7.0.0 through 7.0.9, disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode. For FortiProxy versions 7.2.0 through 7.2.2, disable HTTP/2 support on SSL inspection profiles used by proxy policies or firewall policies with proxy mode. As a temporary workaround, consider disabling the custom-deep-inspection profile until a patch is available. To disable HTTP/2 support, use the following configuration: config firewall ssl-ssh-profile edit "custom-deep-inspection" set supported-alpn http1-1 next end

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121CWE-124CWE-787

Related Identifiers

BDU:2023-03690
CVE-2023-33308

Affected Products

Fortios
Fortiproxy