PT-2025-32869 · Fortinet · Fortiproxy+2

Published 2025-08-12 · Updated 2025-08-13 · CVE-2023-45584

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.2.0 through 7.2.5 and prior to 7.0.12 Fortinet FortiProxy versions 7.2.0 through 7.2.7 and prior to 7.0.13 Fortinet FortiPAM versions 1.1.0 through 1.1.2 and prior to 1.0.3 Fortinet FortiOS version 7.4.0 Fortinet FortiProxy versions 7.4.0 through 7.4.1

Description: A double free vulnerability allows a privileged attacker to execute code or commands via crafted HTTP or HTTPS requests. A double free vulnerability occurs when memory is freed twice, potentially leading to code execution.

Recommendations: Fortinet FortiOS versions prior to 7.0.12: Update to a version later than 7.0.12. Fortinet FortiOS version 7.2.0 through 7.2.5: Update to a version later than 7.2.5. Fortinet FortiProxy versions prior to 7.0.13: Update to a version later than 7.0.13. Fortinet FortiProxy versions 7.2.0 through 7.2.7: Update to a version later than 7.2.7. Fortinet FortiPAM versions prior to 1.0.3: Update to a version later than 1.0.3. Fortinet FortiPAM versions 1.1.0 through 1.1.2: Update to a version later than 1.1.2. Fortinet FortiOS version 7.4.0: Update to a newer version. Fortinet FortiProxy versions 7.4.0 through 7.4.1: Update to a newer version.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

BDU:2025-09925

CVE-2023-45584

Affected Products

Fortios

Fortipam

Fortiproxy

References · 6

• https://fortiguard.fortinet.com/psirt/FG-IR-23-209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45584 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45584 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09925 · Security Note
• https://twitter.com/CVEnew/status/1955535853427757339 · Twitter Post
• https://t.me/cveNotify/131927 · Telegram Post