CVE-2023-25610
Published: 24 March 2025
Summary
CVE-2023-25610 is a critical-severity Buffer Underflow (CWE-124) vulnerability in Fortinet Fortiweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-2 (Flaw Remediation).
Deeper analysis
A buffer underwrite vulnerability tracked as CVE-2023-25610 affects the administrative interface of multiple Fortinet products, including FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.6, 6.4.0 through 6.4.11, and 6.2.12 and earlier; FortiProxy versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, and 2.0.12 and earlier; and FortiOS-6K7K versions 7.0.5, 6.4.0 through 6.4.10, and 6.2.0 through 6.2.10 and earlier. The flaw is classified under CWE-124 and carries a CVSS v3.1 score of 9.8.
Remote unauthenticated attackers can exploit the issue by sending specifically crafted requests to the administrative interface, enabling arbitrary code or command execution with full confidentiality, integrity, and availability impact.
The Fortinet advisory at https://fortiguard.com/psirt/FG-IR-23-001 addresses the vulnerability and provides mitigation guidance for affected releases.
EPSS for the CVE rose from a low baseline to a peak of 0.2551 on 2025-12-18 before receding to the current value of 0.1724, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29551
Vulnerability details
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version…
more
2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer underwrite in admin interface enables remote unauthenticated RCE via crafted requests (T1190: Exploit Public-Facing Application); results in arbitrary code/command execution on FortiOS (T1059.004: Unix Shell).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the buffer underwrite vulnerability by requiring timely patching of affected Fortinet FortiOS, FortiProxy, and FortiOS-6K7K versions.
Enforces boundary protections to block unauthenticated remote access to the vulnerable administrative interface exposed over the network.
Implements memory protection mechanisms like DEP and ASLR to mitigate arbitrary code execution resulting from the buffer underflow exploitation.