Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-25610 is a critical-severity Buffer Underflow (CWE-124) vulnerability in Fortinet Fortiweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A buffer underwrite vulnerability tracked as CVE-2023-25610 affects the administrative interface of multiple Fortinet products, including FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.6, 6.4.0 through 6.4.11, and 6.2.12 and earlier; FortiProxy versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, and 2.0.12 and earlier; and FortiOS-6K7K versions 7.0.5, 6.4.0 through 6.4.10, and 6.2.0 through 6.2.10 and earlier. The flaw is classified under CWE-124 and carries a CVSS v3.1 score of 9.8.
Remote unauthenticated attackers can exploit the issue by sending specifically crafted requests to the administrative interface, enabling arbitrary code or command execution with full confidentiality, integrity, and availability impact.
The Fortinet advisory at https://fortiguard.com/psirt/FG-IR-23-001 addresses the vulnerability and provides mitigation guidance for affected releases.
EPSS for the CVE rose from a low baseline to a peak of 0.2551 on 2025-12-18 before receding to the current value of 0.1724, indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-29551
Vulnerability Data
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version…
more
2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and analysis can discover buffer underwrite flaws before deployment but does not stop their introduction.
Input validation can enforce bounds on indices or pointers before buffer writes, structurally stopping underwrite conditions.
Memory protection mechanisms limit the blast radius of an out-of-bounds write even if the coding flaw exists.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability identification processes can discover buffer underwrite issues but do not prevent their creation.
Patching removes instances of the weakness after discovery but does not address root-cause prevention in code.
Secure SDLC practices directly prevent introduction of buffer underwrite flaws via coding standards, reviews, and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing, developer training) that reach buffer management and can stop underwrite defects from being introduced, but this is only a minority slice of the weakness class because many instances arise from non-SDLC factors like unsafe third-party libraries, runtime misconfigurations, or legacy code not redeveloped under the process.
Application security requirements can specify buffer-size and pointer-safety rules.
Secure architecture and engineering principles require safe memory-handling patterns.
Secure coding standards explicitly forbid unsafe pointer arithmetic and mandate bounds checks.
Security testing in development catches buffer-underflow defects before release.