Common Weakness Enumeration
CWE-134
AllowedUse of Externally-Controlled Format String
Abstraction: Base · Status: Draft
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
499 vulnerabilities reference this CWE, most recent first.
CVE-2023-39239 (GCVE-0-2023-39239)
Vulnerability from cvelistv5 – Published: 2023-09-07 07:18 – Updated: 2024-09-26 18:56
VLAI
EPSS
VEX
Title
ASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2’s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AC86U |
Affected:
3.0.0.4_386_51529
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
|
| asus | rt-ac86u |
Affected:
3.0.0.4_386_51529
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.688Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ac86u",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T18:53:39.966621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T18:56:33.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AC86U",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n\u003cbr\u003e\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2\u2019s General function API. This vulnerability is caused by lacking validation for a specific value within its apply.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:14:38.193Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://https://www.twcert.org.tw/tw/cp-132-7355-0ce8d-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AC86U: update to 3.0.0.4.386_51915\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948\u00a0\n\nRT-AX56U_V2: update to 3.0.0.4.386_51948\u00a0\n\nRT-AC86U: update to 3.0.0.4.386_51915\n\n"
}
],
"source": {
"advisory": "TVN-202309008",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2\u3001RT-AC86U - Format String - 2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39239",
"datePublished": "2023-09-07T07:18:39.017Z",
"dateReserved": "2023-07-26T00:58:24.844Z",
"dateUpdated": "2024-09-26T18:56:33.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-39238 (GCVE-0-2023-39238)
Vulnerability from cvelistv5 – Published: 2023-09-07 07:10 – Updated: 2024-09-26 18:58
VLAI
EPSS
VEX
Title
ASUS RT-AX55、RT-AX56U_V2 - Format String - 1
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX55 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AX56U_V2 |
Affected:
3.0.0.4.386_50460
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ax55 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:* |
Date Public
2023-09-15 01:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:02:06.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ax55:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "rt-ax55",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-39238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T18:57:07.141155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T18:58:30.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX55",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AX56U_V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
}
],
"datePublic": "2023-09-15T01:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u0026nbsp;within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2. This vulnerability is caused by lacking validation for a specific value\u00a0within its set_iperf3_svr.cgi module. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:06:35.024Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7354-4e654-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cp\u003eRT-AX55: update to 3.0.0.4.386_51948\u0026nbsp;\u003c/p\u003e\u003cp\u003eRT-AX56U_V2: update to 3.0.0.4.386_51948\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "\nRT-AX55: update to 3.0.0.4.386_51948\u00a0\n\nRT-AX56U_V2: update to 3.0.0.4.386_51948\u00a0\n\n"
}
],
"source": {
"advisory": "TVN-202309007",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX55\u3001RT-AX56U_V2 - Format String - 1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-39238",
"datePublished": "2023-09-07T07:10:47.153Z",
"dateReserved": "2023-07-26T00:58:24.844Z",
"dateUpdated": "2024-09-26T18:58:30.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-36640 (GCVE-0-2023-36640)
Vulnerability from cvelistv5 – Published: 2024-05-14 16:19 – Updated: 2026-06-12 13:40
VLAI
EPSS
VEX
Summary
A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
15 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiPAM |
Affected:
1.0.0 , ≤ 1.0.3
(semver)
cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:* |
|
| Fortinet | FortiProxy |
Affected:
7.2.0 , ≤ 7.2.4
(semver)
Affected: 7.0.0 , ≤ 7.0.10 (semver) Affected: 2.0.0 , ≤ 2.0.14 (semver) Affected: 1.2.0 , ≤ 1.2.13 (semver) Affected: 1.1.0 , ≤ 1.1.6 (semver) Affected: 1.0.0 , ≤ 1.0.7 (semver) cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.14:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.13:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.12:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.11:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.10:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.13:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.12:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.11:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.10:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.9:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.8:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.2.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.1.0:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.7:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.6:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.5:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.4:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:fortinet:fortiproxy:1.0.0:*:*:*:*:*:*:* |
|
| Fortinet | FortiOS |
Affected:
7.2.0
Affected: 7.0.0 , ≤ 7.0.12 (semver) Affected: 6.4.0 , ≤ 6.4.14 (semver) Affected: 6.2.0 , ≤ 6.2.17 (semver) Affected: 6.0.0 , ≤ 6.0.16 (semver) cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.17:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.16:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.15:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.14:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.13:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.12:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.11:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.10:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.9:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.8:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.5:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.16:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.15:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.14:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.13:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.12:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.11:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.9:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.8:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.7:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.6:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.5:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.4:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiproxy |
Affected:
7.2.0 , ≤ 7.2.5
(custom)
cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortiproxy |
Affected:
7.0.0 , ≤ 7.0.11
(custom)
cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiproxy |
Affected:
1.0.0 , ≤ 2.*
(custom)
cpe:2.3:a:fortinet:fortiproxy:1.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiswitchmanager |
Affected:
7.0.0 , ≤ 7.0.2
(custom)
cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiswitchmanager |
Affected:
7.2.0 , ≤ 7.2.2
(custom)
cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortios |
Affected:
7.4.0
cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:* |
|
| fortinet | fortios |
Affected:
7.2.0 , ≤ 7.2.5
(custom)
cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortios |
Affected:
7.0.0
cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortios |
Affected:
6.4.0
cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:* |
|
| fortinet | fortios |
Affected:
6.2.0
cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:* |
|
| fortinet | fortios |
Affected:
6.0.0 , ≤ 6.0.16
(custom)
cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortipam |
Affected:
1.0.0 , ≤ 1.1.*
(custom)
cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiproxy",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.5",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiproxy",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.11",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiproxy:1.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiproxy",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "2.*",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiswitchmanager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.2",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiswitchmanager",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.2",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.4.0"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.5",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "7.0.0"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.4.0"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "6.2.0"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "6.0.16",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortipam",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "1.1.*",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36640",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-14T17:49:03.425796Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:25:49.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:52:54.010Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-23-137",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.com/psirt/FG-IR-23-137"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:fortinet:fortipam:1.0.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortipam:1.0.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortipam:1.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortipam:1.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiPAM",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.14:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.13:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.11:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.13:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.12:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.11:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:1.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiProxy",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.10",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0.14",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.2.13",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.17:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.16:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.14:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.13:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.16:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.15:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.14:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.13:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiOS",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.2.0"
},
{
"lessThanOrEqual": "7.0.12",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.14",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.17",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.16",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-12T13:40:04.896Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-23-137",
"url": "https://fortiguard.com/psirt/FG-IR-23-137"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiSwitchManager version 7.2.3 or above\nUpgrade to FortiSwitchManager version 7.0.3 or above\nFortinet remediated this issue in FortiSASE version 22.4 and hence customers do not need to perform any action.\nUpgrade to FortiOS version 7.4.1 or above\nUpgrade to FortiOS version 7.2.6 or above\nUpgrade to FortiPAM version 1.1.1 or above\nUpgrade to FortiProxy version 7.2.6 or above\nUpgrade to FortiProxy version 7.0.12 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2023-36640",
"datePublished": "2024-05-14T16:19:21.747Z",
"dateReserved": "2023-06-25T18:03:39.227Z",
"dateUpdated": "2026-06-12T13:40:04.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-36639 (GCVE-0-2023-36639)
Vulnerability from cvelistv5 – Published: 2023-12-13 06:42 – Updated: 2024-08-02 16:52
VLAI
EPSS
VEX
Summary
A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests.
Severity
CWE
- CWE-134 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiOS |
Affected:
7.4.0
Affected: 7.2.0 , ≤ 7.2.4 (semver) Affected: 7.0.0 , ≤ 7.0.11 (semver) Affected: 6.4.0 , ≤ 6.4.12 (semver) Affected: 6.2.0 , ≤ 6.2.15 (semver) Affected: 6.0.0 , ≤ 6.0.17 (semver) |
|
| Fortinet | FortiPAM |
Affected:
1.1.0
Affected: 1.0.0 , ≤ 1.0.3 (semver) |
|
| Fortinet | FortiProxy |
Affected:
7.2.0 , ≤ 7.2.4
(semver)
Affected: 7.0.0 , ≤ 7.0.10 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:52:54.282Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-23-138",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.com/psirt/FG-IR-23-138"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FortiOS",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.4.0"
},
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.11",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.12",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.15",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.17",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiPAM",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiProxy",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.10",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted API requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-13T06:42:44.194Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-23-138",
"url": "https://fortiguard.com/psirt/FG-IR-23-138"
}
],
"solutions": [
{
"lang": "en",
"value": "Please upgrade to FortiOS version 7.4.1 or above \nPlease upgrade to FortiOS version 7.2.5 or above \nPlease upgrade to FortiOS version 7.0.12 or above \nPlease upgrade to FortiOS version 6.4.13 or above \nPlease upgrade to FortiOS version 6.2.16 or above \nPlease upgrade to FortiPAM version 1.2.0 or above \nPlease upgrade to FortiPAM version 1.1.1 or above \nPlease upgrade to FortiProxy version 7.4.0 or above \nPlease upgrade to FortiProxy version 7.2.5 or above \nPlease upgrade to FortiProxy version 7.0.11 or above \nPlease upgrade to FortiSASE version 23.3 or above \n"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2023-36639",
"datePublished": "2023-12-13T06:42:44.194Z",
"dateReserved": "2023-06-25T18:03:39.227Z",
"dateUpdated": "2024-08-02T16:52:54.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35087 (GCVE-0-2023-35087)
Vulnerability from cvelistv5 – Published: 2023-07-21 07:11 – Updated: 2024-10-24 14:17
VLAI
EPSS
VEX
Title
ASUS RT-AX56U V2 & RT-AC86U - Format String - 2
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX56U V2 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AC86U |
Affected:
3.0.0.4_386_51529
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ac86u |
Affected:
3.0.0.4_386_51529
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:* |
Date Public
2023-07-21 06:49
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:23:58.647Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ac86u",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35087",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T14:14:47.697717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T14:17:09.505Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX56U V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AC86U",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"datePublic": "2023-07-21T06:49:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIt is identified a format string vulnerability in ASUS RT-AX56U V2 \u0026amp; RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\u003cbr\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.\u003c/span\u003e"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2 \u0026 RT-AC86U. This vulnerability is caused by lacking validation for a specific value when calling cm_processChangedConfigMsg in ccm_processREQ_CHANGED_CONFIG function in AiMesh system. An unauthenticated remote attacker can exploit this vulnerability without privilege to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\nThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529."
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-21T07:11:03.792Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7249-ab2d1-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eRT-AX56U V2: update firmware version to 3.0.0.4_386_51598\u003cbr\u003eRT-AC86U: \n\nupdate firmware version to\n\n 3.0.0.4.386_51915\u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nRT-AX56U V2: update firmware version to 3.0.0.4_386_51598\nRT-AC86U: \n\nupdate firmware version to\n\n 3.0.0.4.386_51915\n\n\n"
}
],
"source": {
"advisory": "TVN-202307002",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX56U V2 \u0026 RT-AC86U - Format String - 2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-35087",
"datePublished": "2023-07-21T07:11:03.792Z",
"dateReserved": "2023-06-13T10:19:24.131Z",
"dateUpdated": "2024-10-24T14:17:09.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35086 (GCVE-0-2023-35086)
Vulnerability from cvelistv5 – Published: 2023-07-21 06:32 – Updated: 2024-10-24 14:20
VLAI
EPSS
VEX
Title
ASUS RT-AX56U V2 & RT-AC86U - Format String -1
Summary
It is identified a format string vulnerability in ASUS RT-AX56U V2 & RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.
This issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | RT-AX56U V2 |
Affected:
3.0.0.4.386_50460
|
|
| ASUS | RT-AC86U |
Affected:
3.0.0.4_386_51529
|
|
| asus | rt-ax56u_v2 |
Affected:
3.0.0.4.386_50460
cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:* |
|
| asus | rt-ac86u |
Affected:
3.0.0.4_386_51529
cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:* |
Date Public
2023-07-21 06:16
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:23:59.139Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:h:asus:rt-ax56u_v2:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ax56u_v2",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"cpes": [
"cpe:2.3:h:asus:rt-ac86u:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "rt-ac86u",
"vendor": "asus",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35086",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-24T14:18:13.719783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-24T14:20:09.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "RT-AX56U V2",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4.386_50460"
}
]
},
{
"defaultStatus": "unaffected",
"product": "RT-AC86U",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "3.0.0.4_386_51529"
}
]
}
],
"datePublic": "2023-07-21T06:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIt is identified a format string vulnerability in ASUS RT-AX56U V2 \u0026amp; RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\u003c/span\u003e\n\n\u003cp\u003eThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.\u003c/p\u003e"
}
],
"value": "\nIt is identified a format string vulnerability in ASUS RT-AX56U V2 \u0026 RT-AC86U. This vulnerability is caused by directly using input as a format string when calling syslog in logmessage_normal function, in the do_detwan_cgi module of httpd. A remote attacker with administrator privilege can exploit this vulnerability to perform remote arbitrary code execution, arbitrary system operation or disrupt service.\n\nThis issue affects RT-AX56U V2: 3.0.0.4.386_50460; RT-AC86U: 3.0.0.4_386_51529.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-135",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-135 Format String Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-27T07:21:52.292Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"url": "https://www.twcert.org.tw/tw/cp-132-7240-a5f96-1.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cdiv\u003eRT-AX56U V2: update firmware version to 3.0.0.4_386_51598\u003c/div\u003e\u003cdiv\u003eRT-AC86U: \n\nupdate firmware version\n\n 3.0.0.4.386_51915\u003c/div\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nRT-AX56U V2: update firmware version to 3.0.0.4_386_51598\n\nRT-AC86U: \n\nupdate firmware version\n\n 3.0.0.4.386_51915\n\n"
}
],
"source": {
"advisory": "TVN-202307001",
"discovery": "EXTERNAL"
},
"title": "ASUS RT-AX56U V2 \u0026 RT-AC86U - Format String -1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2023-35086",
"datePublished": "2023-07-21T06:32:20.831Z",
"dateReserved": "2023-06-13T10:19:24.130Z",
"dateUpdated": "2024-10-24T14:20:09.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-33011 (GCVE-0-2023-33011)
Vulnerability from cvelistv5 – Published: 2023-07-17 17:15 – Updated: 2024-11-07 19:08
VLAI
EPSS
VEX
Summary
A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zyxel | ATP series firmware |
Affected:
5.10 through 5.36 Patch 2
|
|
| Zyxel | USG FLEX series firmware |
Affected:
5.00 through 5.36 Patch 2
|
|
| Zyxel | USG FLEX 50(W) series firmware |
Affected:
5.10 through 5.36 Patch 2
|
|
| Zyxel | USG20(W)-VPN series firmware |
Affected:
5.10 through 5.36 Patch 2
|
|
| Zyxel | VPN series firmware |
Affected:
5.00 through 5.36 Patch 2
|
|
| zyxel | vpn_series_firmware |
Affected:
5.00 , ≤ 5.36_patch_2
(custom)
cpe:2.3:o:zyxel:vpn_series_firmware:*:*:*:*:*:*:*:* |
|
| zyxel | atp100_firmware |
Affected:
5.10 , ≤ 5.36_patch_2
(custom)
cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:* |
|
| zyxel | usg_flex_series_firmware |
Affected:
5.0.0 , ≤ 5.36_patch_2
(custom)
cpe:2.3:o:zyxel:usg_flex_series_firmware:*:*:*:*:*:*:*:* |
|
| zyxel | usg_flex_50\/w\/_series_firmware |
Affected:
5.10 , ≤ 5.36_patch_2
(custom)
cpe:2.3:o:zyxel:usg_flex_50\/w\/_series_firmware:*:*:*:*:*:*:*:* |
|
| zyxel | usg20w-vpn_firmware |
Affected:
5.10 , ≤ 5.36_patch_2
(custom)
cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:32:46.611Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:zyxel:vpn_series_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "vpn_series_firmware",
"vendor": "zyxel",
"versions": [
{
"lessThanOrEqual": "5.36_patch_2",
"status": "affected",
"version": "5.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "atp100_firmware",
"vendor": "zyxel",
"versions": [
{
"lessThanOrEqual": "5.36_patch_2",
"status": "affected",
"version": "5.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zyxel:usg_flex_series_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usg_flex_series_firmware",
"vendor": "zyxel",
"versions": [
{
"lessThanOrEqual": "5.36_patch_2",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zyxel:usg_flex_50\\/w\\/_series_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usg_flex_50\\/w\\/_series_firmware",
"vendor": "zyxel",
"versions": [
{
"lessThanOrEqual": "5.36_patch_2",
"status": "affected",
"version": "5.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "usg20w-vpn_firmware",
"vendor": "zyxel",
"versions": [
{
"lessThanOrEqual": "5.36_patch_2",
"status": "affected",
"version": "5.10",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-33011",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-07T18:57:20.597639Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-07T19:08:01.595Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ATP series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "5.10 through 5.36 Patch 2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "USG FLEX series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "5.00 through 5.36 Patch 2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "USG FLEX 50(W) series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "5.10 through 5.36 Patch 2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "USG20(W)-VPN series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "5.10 through 5.36 Patch 2"
}
]
},
{
"defaultStatus": "unaffected",
"product": "VPN series firmware",
"vendor": "Zyxel",
"versions": [
{
"status": "affected",
"version": "5.00 through 5.36 Patch 2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled."
}
],
"value": "A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50(W) series firmware versions 5.10 through 5.36 Patch 2, USG20(W)-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN series firmware versions 5.00 through 5.36 Patch 2, could allow an unauthenticated, LAN-based attacker to execute some OS commands by using a crafted PPPoE configuration on an affected device when the cloud management mode is enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-17T17:15:45.876Z",
"orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"shortName": "Zyxel"
},
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-and-wlan-controllers"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
"assignerShortName": "Zyxel",
"cveId": "CVE-2023-33011",
"datePublished": "2023-07-17T17:15:45.876Z",
"dateReserved": "2023-05-17T02:56:16.623Z",
"dateUpdated": "2024-11-07T19:08:01.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-29181 (GCVE-0-2023-29181)
Vulnerability from cvelistv5 – Published: 2024-02-22 09:40 – Updated: 2024-08-22 17:41
VLAI
EPSS
VEX
Summary
A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted command.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Execute unauthorized code or commands
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiPAM |
Affected:
1.0.0 , ≤ 1.0.3
(semver)
|
|
| Fortinet | FortiOS |
Affected:
7.2.0 , ≤ 7.2.4
(semver)
Affected: 7.0.0 , ≤ 7.0.11 (semver) Affected: 6.4.0 , ≤ 6.4.12 (semver) Affected: 6.2.0 , ≤ 6.2.14 (semver) Affected: 6.0.0 , ≤ 6.0.16 (semver) Affected: 5.6.0 , ≤ 5.6.14 (semver) Affected: 5.4.0 , ≤ 5.4.13 (semver) Affected: 5.2.0 , ≤ 5.2.15 (semver) Affected: 5.0.0 , ≤ 5.0.14 (semver) Affected: 4.3.0 , ≤ 4.3.19 (semver) Affected: 4.2.0 , ≤ 4.2.16 (semver) Affected: 4.1.1 , ≤ 4.1.11 (semver) Affected: 4.0.0 , ≤ 4.0.4 (semver) |
|
| Fortinet | FortiProxy |
Affected:
7.2.0 , ≤ 7.2.4
(semver)
Affected: 7.0.0 , ≤ 7.0.10 (semver) Affected: 2.0.0 , ≤ 2.0.12 (semver) Affected: 1.2.0 , ≤ 1.2.13 (semver) Affected: 1.1.0 , ≤ 1.1.6 (semver) Affected: 1.0.0 , ≤ 1.0.7 (semver) |
|
| fortinet | fortios |
Affected:
7.2.0 , ≤ 7.2.4
(semver)
Affected: 7.0.0 , ≤ 7.0.11 (semver) Affected: 6.4.0 , ≤ 6.4.12 (semver) Affected: 6.2.0 , ≤ 6.2.14 (semver) Affected: 5.6.0 , ≤ 5.6.14 (custom) Affected: 5.4.0 , ≤ 5.4.13 (custom) Affected: 5.2.0 , ≤ 5.2.15 (custom) Affected: 5.0.0 , ≤ 5.0.14 (custom) Affected: 4.3.0 , ≤ 4.3.19 (custom) Affected: 4.2.0 , ≤ 4.1.11 (custom) Affected: 4.1.1 , ≤ 4.1.11 (custom) Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 6.0.0 , ≤ 6.2.14 (semver) cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
|
| fortinet | fortipam |
Affected:
1.00 , ≤ 1.0.3
(semver)
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:* |
|
| fortinet | fortiproxy |
Affected:
7.2.0 , ≤ 7.2.4
(semver)
Affected: 7.0.0 , ≤ 7.0.10 (semver) Affected: 2.0.0 , ≤ 2.0.12 (semver) Affected: 1.2.0 , ≤ 1.2.13 (semver) Affected: 1.1.0 , ≤ 1.1.6 (semver) Affected: 1.0.0 , ≤ 1.0.7 (semver) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:00:15.852Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-23-119",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.com/psirt/FG-IR-23-119"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortios",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.11",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.12",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.14",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.6.14",
"status": "affected",
"version": "5.6.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4.13",
"status": "affected",
"version": "5.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.15",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.0.14",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.3.19",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.1.11",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.1.11",
"status": "affected",
"version": "4.1.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.2.14",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortipam",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "1.00",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "fortiproxy",
"vendor": "fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.10",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0.12",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.2.13",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-29181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-22T16:59:29.245878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-22T17:41:03.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FortiPAM",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "1.0.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiOS",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.11",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.12",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.14",
"status": "affected",
"version": "6.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.16",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.6.14",
"status": "affected",
"version": "5.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.13",
"status": "affected",
"version": "5.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.15",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.14",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.3.19",
"status": "affected",
"version": "4.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.16",
"status": "affected",
"version": "4.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.1.11",
"status": "affected",
"version": "4.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "FortiProxy",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.4",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.10",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0.12",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.2.13",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via specially crafted command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-22T09:40:06.212Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.com/psirt/FG-IR-23-119",
"url": "https://fortiguard.com/psirt/FG-IR-23-119"
}
],
"solutions": [
{
"lang": "en",
"value": "Please upgrade to FortiOS version 7.4.0 or above\nPlease upgrade to FortiOS version 7.2.5 or above\nPlease upgrade to FortiOS version 7.0.12 or above\nPlease upgrade to FortiOS version 6.4.13 or above\nPlease upgrade to FortiOS version 6.2.15 or above\nPlease upgrade to FortiProxy version 7.2.5 or above\nPlease upgrade to FortiProxy version 7.0.11 or above\nPlease upgrade to FortiProxy version 2.0.13 or above\nPlease upgrade to FortiPAM version 1.1.0 or above\n"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2023-29181",
"datePublished": "2024-02-22T09:40:06.212Z",
"dateReserved": "2023-04-03T08:47:30.452Z",
"dateUpdated": "2024-08-22T17:41:03.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-25815 (GCVE-0-2023-25815)
Vulnerability from cvelistv5 – Published: 2023-04-25 19:51 – Updated: 2025-11-04 16:09
VLAI
EPSS
VEX
Title
Git looks for localized messages in the wrong place
Summary
In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.
This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`.
Severity
CWE
Assigner
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| git-for-windows | git |
Affected:
< 2.40.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-04T16:09:59.699Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"
},
{
"name": "https://github.com/msys2/MINGW-packages/pull/10461",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/msys2/MINGW-packages/pull/10461"
},
{
"name": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"
},
{
"name": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"
},
{
"name": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2023/04/25/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202312-15"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "git",
"vendor": "git-for-windows",
"versions": [
{
"status": "affected",
"version": "\u003c 2.40.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function\u0027s implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\\mingw64\\share\\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\\` (and since `C:\\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1.\n\nThis vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\\`."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134: Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T10:05:59.527Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/git-for-windows/git/security/advisories/GHSA-9w66-8mq8-5vm8"
},
{
"name": "https://github.com/msys2/MINGW-packages/pull/10461",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/msys2/MINGW-packages/pull/10461"
},
{
"name": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack",
"tags": [
"x_refsource_MISC"
],
"url": "https://axcheron.github.io/exploit-101-format-strings/#writing-to-the-stack"
},
{
"name": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/git-for-windows/git/releases/tag/v2.40.1.windows.1"
},
{
"name": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html",
"tags": [
"x_refsource_MISC"
],
"url": "https://pubs.opengroup.org/onlinepubs/9699919799/functions/printf.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/04/25/2"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/"
},
{
"url": "https://security.gentoo.org/glsa/202312-15"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html"
}
],
"source": {
"advisory": "GHSA-9w66-8mq8-5vm8",
"discovery": "UNKNOWN"
},
"title": "Git looks for localized messages in the wrong place"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-25815",
"datePublished": "2023-04-25T19:51:38.433Z",
"dateReserved": "2023-02-15T16:34:48.773Z",
"dateUpdated": "2025-11-04T16:09:59.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-25492 (GCVE-0-2023-25492)
Vulnerability from cvelistv5 – Published: 2023-05-01 14:11 – Updated: 2025-01-30 15:53
VLAI
EPSS
VEX
Summary
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Lenovo | XClarity Controller |
Affected:
See product security advisory below
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:25:18.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://support.lenovo.com/us/en/product_security/LEN-99936"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-25492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-30T15:51:15.735407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T15:53:03.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XClarity Controller",
"vendor": "Lenovo",
"versions": [
{
"status": "affected",
"version": "See product security advisory below"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API."
}
],
"value": "A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "CWE-134 Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-01T14:11:48.551Z",
"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"shortName": "lenovo"
},
"references": [
{
"url": "https://support.lenovo.com/us/en/product_security/LEN-99936"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Customers should update to the version (or later) of Lenovo XClarity Controller (XCC) identified in the related Lenovo Product Security Advisory:\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.lenovo.com/us/en/product_security/LEN-99936\"\u003ehttps://support.lenovo.com/us/en/product_security/LEN-99936\u003c/a\u003e"
}
],
"value": "Customers should update to the version (or later) of Lenovo XClarity Controller (XCC) identified in the related Lenovo Product Security Advisory:\n https://support.lenovo.com/us/en/product_security/LEN-99936 https://support.lenovo.com/us/en/product_security/LEN-99936 "
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
"assignerShortName": "lenovo",
"cveId": "CVE-2023-25492",
"datePublished": "2023-05-01T14:11:48.551Z",
"dateReserved": "2023-02-06T15:09:03.709Z",
"dateUpdated": "2025-01-30T15:53:03.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Requirements
Choose a language that is not subject to this flaw.
Mitigation
Implementation
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
Mitigation
Build and Compilation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
CAPEC-135: Format String Injection
An adversary includes formatting characters in a string input field on the target application. Most applications assume that users will provide static text and may respond unpredictably to the presence of formatting character. For example, in certain functions of the C programming languages such as printf, the formatting character %s will print the contents of a memory location expecting this location to identify a string and the formatting character %n prints the number of DWORD written in the memory. An adversary can use this to read or write to memory locations or files, or simply to manipulate the value of the resulting text in unexpected ways. Reading or writing memory may result in program crashes and writing memory could result in the execution of arbitrary code if the adversary can write to the program stack.
CAPEC-67: String Format Overflow in syslog()
This attack targets applications and software that uses the syslog() function insecurely. If an application does not explicitely use a format string parameter in a call to syslog(), user input can be placed in the format string parameter leading to a format string injection attack. Adversaries can then inject malicious format string commands into the function call leading to a buffer overflow. There are many reported software vulnerabilities with the root cause being a misuse of the syslog() function.