PT-2025-15424 · Fortinet · Fortiproxy+1

Published 2025-04-08 · Updated 2025-07-23 · CVE-2023-37930

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.4.7 through 6.4.14 Fortinet FortiOS versions 7.0.1 through 7.0.11 Fortinet FortiOS version 7.4.0 Fortinet FortiProxy versions 7.0.0 through 7.0.12 Fortinet FortiProxy versions 7.2.0 through 7.2.6

Description The vulnerability involves issues related to the use of uninitialized resources [CWE-908] and excessive iteration [CWE-834]. A VPN user can potentially corrupt memory through specifically crafted requests, which may lead to code or command execution.

Recommendations Fortinet FortiOS versions prior to 6.4.7 should be updated. Fortinet FortiOS versions prior to 7.0.1 should be updated. Fortinet FortiOS version 7.4.0 should be updated. Fortinet FortiProxy versions prior to 7.0.0 should be updated. Fortinet FortiProxy versions prior to 7.2.0 should be updated.

Fix

RCE

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

BDU:2025-07600

CVE-2023-37930

Affected Products

Fortios

Fortiproxy

References · 12

• https://fortiguard.com/psirt/FG-IR-23-165 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-07600 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37930 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37930 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-23-165 · Note
• https://darkforums.st/Thread-Selling-Fortinet-Fortigate-vpn-0day-Exploit?highlight=Fortinet · Note
• https://t.me/cvetracker/21129 · Telegram Post
• https://twitter.com/CVEnew/status/1909616783033508109 · Twitter Post
• https://t.me/cveNotify/130012 · Telegram Post
• https://t.me/cvedetector/22471 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1909648240569471357 · Twitter Post