Depending on the targeted device, this may result in either a denial of service (DoS) on its GUI or may allow the attacker to execute arbitrary code on the device.

FortiProxy is a secure web proxy that protects users against internet-borne attacks.ĬVE-2023-25610 can be expoited without prior authentication by remote attackers by sending specially crafted requests.

Linux-based FortiOS powers many Fortinet’s products, including its FortiGate firewalls and various switches. About CVE-2023-25610ĭiscovered by Fortinet infosec engineer Kai Ni, CVE-2023-25610 is a buffer underwrite (‘buffer underflow’) vulnerability found in the FortiOS and FortiProxy administrative interface. None of the patched vulnerabilities is actively exploited, but Fortinet’s devices are often targeted by ransomware gangs and other cyber attackers, so implementing the offered security updates quickly is advised. Fortinet has patched 15 vulnerabilities in a variety of its products, including CVE-2023-25610, a critical flaw affecting devices running FortiOS and FortiProxy.