FortiOS / FortiProxy / FortiPAM / FortiSwitchManager - Format string vulnerability in CLI commands Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-23-261 Final 1 1 2025-02-11T00:00:00 Current version 2025-02-11T00:00:00 2025-02-12T00:00:00 A use of externally-controlled format string vulnerability [CWE-134] in FortiOS, FortiProxy, FortiPAM & FortiSwitchManager CLI may allow a privileged attacker to execute arbitrary code or commands via specially crafted requests. None Execute unauthorized code or commands FortiSwitchManager version 7.2.0 through 7.2.2FortiSwitchManager version 7.0.0 through 7.0.2FortiProxy 7.6 all versions are not affectedFortiProxy version 7.4.0FortiProxy version 7.2.0 through 7.2.6FortiProxy version 7.0.0 through 7.0.14FortiProxy 2.0 all versionsFortiProxy 1.2 all versionsFortiPAM 1.5 all versions are not affectedFortiPAM 1.4 all versions are not affectedFortiPAM 1.3 all versions are not affectedFortiPAM 1.2 all versions are not affectedFortiPAM version 1.1.0 through 1.1.2FortiPAM 1.0 all versionsFortiOS 7.6 all versions are not affectedFortiOS version 7.4.0FortiOS version 7.2.0 through 7.2.6FortiOS version 7.0.0 through 7.0.13FortiOS 6.4 all versionsFortiOS 6.2 all versions Please upgrade to FortiOS version 7.4.2 or abovePlease upgrade to FortiOS version 7.2.7 or abovePlease upgrade to FortiOS version 7.0.14 or abovePlease upgrade to FortiPAM version 1.2.0 or abovePlease upgrade to FortiSwitchManager version 7.2.3 or abovePlease upgrade to FortiSwitchManager version 7.0.3 or abovePlease upgrade to FortiProxy version 7.4.1 or abovePlease upgrade to FortiProxy version 7.2.8 or abovePlease upgrade to FortiProxy version 7.0.15 or above Fortinet is pleased to thank Ryan Quasney from BishopFox for bringing this issue to our attention under responsible disclosure. FortiOS 7.4.0 FortiOS 7.2.6 FortiOS 7.2.5 FortiOS 7.2.4 FortiOS 7.2.3 FortiOS 7.2.2 FortiOS 7.2.1 FortiOS 7.2.0 FortiOS 7.0.13 FortiOS 7.0.12 FortiOS 7.0.11 FortiOS 7.0.10 FortiOS 7.0.9 FortiOS 7.0.8 FortiOS 7.0.7 FortiOS 7.0.6 FortiOS 7.0.5 FortiOS 7.0.4 FortiOS 7.0.3 FortiOS 7.0.2 FortiOS 7.0.1 FortiOS 7.0.0 FortiOS 6.4.16 FortiOS 6.4.15 FortiOS 6.4.14 FortiOS 6.4.13 FortiOS 6.4.12 FortiOS 6.4.11 FortiOS 6.4.10 FortiOS 6.4.9 FortiOS 6.4.8 FortiOS 6.4.7 FortiOS 6.4.6 FortiOS 6.4.5 FortiOS 6.4.4 FortiOS 6.4.3 FortiOS 6.4.2 FortiOS 6.4.1 FortiOS 6.4.0 FortiOS 6.2.17 FortiOS 6.2.16 FortiOS 6.2.15 FortiOS 6.2.14 FortiOS 6.2.13 FortiOS 6.2.12 FortiOS 6.2.11 FortiOS 6.2.10 FortiOS 6.2.9 FortiOS 6.2.8 FortiOS 6.2.7 FortiOS 6.2.6 FortiOS 6.2.5 FortiOS 6.2.4 FortiOS 6.2.3 FortiOS 6.2.2 FortiOS 6.2.1 FortiOS 6.2.0 FortiPAM 1.1.2 FortiPAM 1.1.1 FortiPAM 1.1.0 FortiPAM 1.0.3 FortiPAM 1.0.2 FortiPAM 1.0.1 FortiPAM 1.0.0 FortiProxy 7.4.0 FortiProxy 7.2.6 FortiProxy 7.2.5 FortiProxy 7.2.4 FortiProxy 7.2.3 FortiProxy 7.2.2 FortiProxy 7.2.1 FortiProxy 7.2.0 FortiProxy 7.0.14 FortiProxy 7.0.13 FortiProxy 7.0.12 FortiProxy 7.0.11 FortiProxy 7.0.10 FortiProxy 7.0.9 FortiProxy 7.0.8 FortiProxy 7.0.7 FortiProxy 7.0.6 FortiProxy 7.0.5 FortiProxy 7.0.4 FortiProxy 7.0.3 FortiProxy 7.0.2 FortiProxy 7.0.1 FortiProxy 7.0.0 FortiProxy 2.0.14 FortiProxy 2.0.13 FortiProxy 2.0.12 FortiProxy 2.0.11 FortiProxy 2.0.10 FortiProxy 2.0.9 FortiProxy 2.0.8 FortiProxy 2.0.7 FortiProxy 2.0.6 FortiProxy 2.0.5 FortiProxy 2.0.4 FortiProxy 2.0.3 FortiProxy 2.0.2 FortiProxy 2.0.1 FortiProxy 2.0.0 FortiProxy 1.2.13 FortiProxy 1.2.12 FortiProxy 1.2.11 FortiProxy 1.2.10 FortiProxy 1.2.9 FortiProxy 1.2.8 FortiProxy 1.2.7 FortiProxy 1.2.6 FortiProxy 1.2.5 FortiProxy 1.2.4 FortiProxy 1.2.3 FortiProxy 1.2.2 FortiProxy 1.2.1 FortiProxy 1.2.0 FortiSwitchManager 7.2.2 FortiSwitchManager 7.2.1 FortiSwitchManager 7.2.0 FortiSwitchManager 7.0.2 FortiSwitchManager 7.0.1 FortiSwitchManager 7.0.0 CVE-2023-40721 FortiOS-7.4.0 FortiOS-7.2.6 FortiOS-7.2.5 FortiOS-7.2.4 FortiOS-7.2.3 FortiOS-7.2.2 FortiOS-7.2.1 FortiOS-7.2.0 FortiOS-7.0.13 FortiOS-7.0.12 FortiOS-7.0.11 FortiOS-7.0.10 FortiOS-7.0.9 FortiOS-7.0.8 FortiOS-7.0.7 FortiOS-7.0.6 FortiOS-7.0.5 FortiOS-7.0.4 FortiOS-7.0.3 FortiOS-7.0.2 FortiOS-7.0.1 FortiOS-7.0.0 FortiOS-6.4.16 FortiOS-6.4.15 FortiOS-6.4.14 FortiOS-6.4.13 FortiOS-6.4.12 FortiOS-6.4.11 FortiOS-6.4.10 FortiOS-6.4.9 FortiOS-6.4.8 FortiOS-6.4.7 FortiOS-6.4.6 FortiOS-6.4.5 FortiOS-6.4.4 FortiOS-6.4.3 FortiOS-6.4.2 FortiOS-6.4.1 FortiOS-6.4.0 FortiOS-6.2.17 FortiOS-6.2.16 FortiOS-6.2.15 FortiOS-6.2.14 FortiOS-6.2.13 FortiOS-6.2.12 FortiOS-6.2.11 FortiOS-6.2.10 FortiOS-6.2.9 FortiOS-6.2.8 FortiOS-6.2.7 FortiOS-6.2.6 FortiOS-6.2.5 FortiOS-6.2.4 FortiOS-6.2.3 FortiOS-6.2.2 FortiOS-6.2.1 FortiOS-6.2.0 FortiPAM-1.1.2 FortiPAM-1.1.1 FortiPAM-1.1.0 FortiPAM-1.0.3 FortiPAM-1.0.2 FortiPAM-1.0.1 FortiPAM-1.0.0 FortiProxy-7.4.0 FortiProxy-7.2.6 FortiProxy-7.2.5 FortiProxy-7.2.4 FortiProxy-7.2.3 FortiProxy-7.2.2 FortiProxy-7.2.1 FortiProxy-7.2.0 FortiProxy-7.0.14 FortiProxy-7.0.13 FortiProxy-7.0.12 FortiProxy-7.0.11 FortiProxy-7.0.10 FortiProxy-7.0.9 FortiProxy-7.0.8 FortiProxy-7.0.7 FortiProxy-7.0.6 FortiProxy-7.0.5 FortiProxy-7.0.4 FortiProxy-7.0.3 FortiProxy-7.0.2 FortiProxy-7.0.1 FortiProxy-7.0.0 FortiProxy-2.0.14 FortiProxy-2.0.13 FortiProxy-2.0.12 FortiProxy-2.0.11 FortiProxy-2.0.10 FortiProxy-2.0.9 FortiProxy-2.0.8 FortiProxy-2.0.7 FortiProxy-2.0.6 FortiProxy-2.0.5 FortiProxy-2.0.4 FortiProxy-2.0.3 FortiProxy-2.0.2 FortiProxy-2.0.1 FortiProxy-2.0.0 FortiProxy-1.2.13 FortiProxy-1.2.12 FortiProxy-1.2.11 FortiProxy-1.2.10 FortiProxy-1.2.9 FortiProxy-1.2.8 FortiProxy-1.2.7 FortiProxy-1.2.6 FortiProxy-1.2.5 FortiProxy-1.2.4 FortiProxy-1.2.3 FortiProxy-1.2.2 FortiProxy-1.2.1 FortiProxy-1.2.0 FortiSwitchManager-7.2.2 FortiSwitchManager-7.2.1 FortiSwitchManager-7.2.0 FortiSwitchManager-7.0.2 FortiSwitchManager-7.0.1 FortiSwitchManager-7.0.0 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C https://fortiguard.fortinet.com/psirt/FG-IR-23-261 FortiOS / FortiProxy / FortiPAM / FortiSwitchManager - Format string vulnerability in CLI commands Reference>