CVE-2023-40721

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-40721
A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fortiguard.com/psirt/FG-IR-23-261 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*
History

14 Jan 2026, 15:15

Type Values Removed Values Added
Summary (en) A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiOS version 7.4.0 through 7.4.1 and before 7.2.6, FortiProxy version 7.4.0 and before 7.2.7, FortiPAM version 1.1.2 and before 1.0.3, FortiSwitchManager version 7.2.0 through 7.2.2 and before 7.0.2 allows a privileged attacker to execute arbitrary code or commands via specially crafted requests. (en) A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

24 Jul 2025, 19:04

Type Values Removed Values Added
References () https://fortiguard.com/psirt/FG-IR-23-261 - () https://fortiguard.com/psirt/FG-IR-23-261 - Vendor Advisory
First Time Fortinet fortipam
Fortinet
Fortinet fortiproxy
Fortinet fortios
Fortinet fortiswitchmanager
CPE cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Summary
  • (es) Una vulnerabilidad de uso de cadena de formato controlada externamente [CWE-134] en Fortinet FortiOS versión 7.4.0 a 7.4.1 y anteriores a 7.2.6, FortiProxy versión 7.4.0 y anteriores a 7.2.7, FortiPAM versión 1.1.2 y anteriores a 1.0.3, FortiSwitchManager versión 7.2.0 a 7.2.2 y anteriores a 7.0.2 permite a un atacante privilegiado ejecutar código o comandos arbitrarios a través de solicitudes especialmente manipuladas.

11 Feb 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-11 17:15

Updated : 2026-01-14 15:15

NVD link : CVE-2023-40721

Mitre link : CVE-2023-40721

CVE.ORG link : CVE-2023-40721

JSON object : View

Products Affected

fortinet

  • fortiswitchmanager
  • fortiproxy
  • fortipam
  • fortios
CWE
CWE-134

Use of Externally-Controlled Format String