What’s Vulnerable › Vulnerabilities

CVE-2023-41842

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-12 · updated 2026-06-17
• Weakness: CWE-134

Description

A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute unauthorized code or commands via specially crafted command arguments.

Affected products

• Fortinet FortiAnalyzer: from 6.2.0 before 7.0.10; from 7.2.0 before 7.2.4; from 7.4.0 before 7.4.2 — fixed in 7.0.10, 7.2.4, 7.4.2
• Fortinet Fortianalyzer Big Data: from 6.4.5 through 6.4.7; from 7.0.1 through 7.0.6; from 7.2.0 before 7.2.6; 6.2.5 — fixed in 7.2.6
• Fortinet FortiManager: from 6.2.0 before 7.0.10; from 7.2.0 before 7.2.4; from 7.4.0 before 7.4.2 — fixed in 7.0.10, 7.2.4, 7.4.2
• Fortinet FortiPortal: from 5.3.0 before 6.0.15 — fixed in 6.0.15

How to fix

Upgrade to a fixed version: Fortinet FortiAnalyzer 7.0.10, 7.2.4, 7.4.2; Fortinet Fortianalyzer Big Data 7.2.6; Fortinet FortiManager 7.0.10, 7.2.4, 7.4.2; Fortinet FortiPortal 6.0.15. Check the vendor advisory for mitigations.

References

• https://fortiguard.com/psirt/FG-IR-23-304
• https://fortiguard.com/psirt/FG-IR-23-304

Get alerted when CVE-2023-41842 or the next vulnerability affects your stack