CVE-2023-37930

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-37930
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fortiguard.com/psirt/FG-IR-23-165 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
History

14 Jan 2026, 14:16

Type Values Removed Values Added
Summary (en) Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities in Fortinet FortiOS SSL VPN webmode version 7.4.0, version 7.2.0 through 7.2.5, version 7.0.1 through 7.0.11 and version 6.4.7 through 6.4.14 and Fortinet FortiProxy SSL VPN webmode version 7.2.0 through 7.2.6 and version 7.0.0 through 7.0.12 allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests. (en) Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.

23 Jul 2025, 16:01

Type Values Removed Values Added
CPE cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
First Time Fortinet
Fortinet fortios
Fortinet fortiproxy
Summary
  • (es) Varios problemas, incluido el uso de recursos no inicializados [CWE-908] y las vulnerabilidades de iteración excesiva [CWE-834] en Fortinet FortiOS SSL VPN webmode versión 7.4.0, versión 7.2.0 a 7.2.5, versión 7.0.1 a 7.0.11 y versión 6.4.7 a 6.4.14 y Fortinet FortiProxy SSL VPN webmode versión 7.2.0 a 7.2.6 y versión 7.0.0 a 7.0.12 permiten que un usuario de VPN corrompa la memoria, lo que potencialmente lleva a la ejecución de código o comandos a través de solicitudes específicamente manipuladas.
References () https://fortiguard.com/psirt/FG-IR-23-165 - () https://fortiguard.com/psirt/FG-IR-23-165 - Vendor Advisory

08 Apr 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-08 14:15

Updated : 2026-01-14 14:16

NVD link : CVE-2023-37930

Mitre link : CVE-2023-37930

CVE.ORG link : CVE-2023-37930

JSON object : View

Products Affected

fortinet

  • fortiproxy
  • fortios
CWE
CWE-908

Use of Uninitialized Resource