CVE-2023-29177

Summary

Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0 and before 6.4.1 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiDDoS-F6.5.0affected
FortinetFortiDDoS-F6.4.0 <= 6.4.1affected
FortinetFortiDDoS-F6.3.0 <= 6.3.4affected
FortinetFortiDDoS-F6.2.0 <= 6.2.3affected
FortinetFortiDDoS-F6.1.0 <= 6.1.4affected
FortinetFortiADC7.2.0affected
FortinetFortiADC7.1.0 <= 7.1.2affected
FortinetFortiADC7.0.0 <= 7.0.5affected
FortinetFortiADC6.2.0 <= 6.2.6affected
FortinetFortiADC6.1.0 <= 6.1.6affected
FortinetFortiADC6.0.0 <= 6.0.4affected
FortinetFortiADC5.4.0 <= 5.4.5affected
FortinetFortiADC5.3.0 <= 5.3.7affected
FortinetFortiADC5.2.0 <= 5.2.8affected

Weaknesses

  • CWE-120: Execute unauthorized code or commands

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References