PT-2023-5206 · Fortinet · Fortitester

Published 2023-08-21 · Updated 2023-09-15 · CVE-2023-40717

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiTester versions 2.3.0 through 7.2.3

Description A use of hard-coded credentials issue in FortiTester may allow an attacker who has gained shell access to the device to access the database via shell commands. This could potentially lead to unauthorized access to protected information and the execution of arbitrary commands.

Recommendations For FortiTester versions 2.3.0 through 7.2.3, consider disabling shell access to the device until a patch is available to prevent exploitation of the hard-coded credentials. Restrict access to the database to minimize the risk of unauthorized data access.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2023-05812

CVE-2023-40717

Affected Products

Fortitester

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-40717 · Security Note
• https://fortiguard.com/psirt/FG-IR-22-245 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05812 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40717 · Vendor Advisory
• https://twitter.com/CVEnew/status/1701942518768709743 · Twitter Post
• https://vuldb.com/ru/?id.239668 · Note
• https://t.me/cibsecurity/70378 · Telegram Post