FortiOS.HTTPSd.Daemon.CVE-2023-36639.Memory.Corruption

Description

This indicates an attack attempt to exploit a Format String vulnerability in FortiOS, FortiProxy and FortiPAM.
A format string vulnerability in the HTTPSd daemon of FortiOS, FortiProxy and FortiPAM may allow an authenticated user to execute unauthorized code or commands via specially crafted API requests.

Affected Products

FortiOS 7.4.0
FortiOS 7.2.0 through 7.2.4
FortiOS 7.0.0 through 7.0.11
FortiOS 6.4.0 through 6.4.12
FortiOS 6.2.0 through 6.2.15
FortiOS 6.0 all versions
FortiPAM 1.1.0
FortiPAM 1.0 all versions
FortiProxy 7.2.0 through 7.2.4
FortiProxy 7.0.0 through 7.0.10

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
https://www.fortiguard.com/psirt/FG-IR-23-138

References