CVE-2023-25610
Published: 24 March 2025
Summary
CVE-2023-25610 is a critical-severity Buffer Underflow (CWE-124) vulnerability in Fortinet Fortiweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer underwrite vulnerability by requiring timely patching of affected Fortinet FortiOS, FortiProxy, and FortiOS-6K7K versions.
Enforces boundary protections to block unauthenticated remote access to the vulnerable administrative interface exposed over the network.
Implements memory protection mechanisms like DEP and ASLR to mitigate arbitrary code execution resulting from the buffer underflow exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer underwrite in admin interface enables remote unauthenticated RCE via crafted requests (T1190: Exploit Public-Facing Application); results in arbitrary code/command execution on FortiOS (T1059.004: Unix Shell).
NVD Description
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version…
more
2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Deeper analysisAI
CVE-2023-25610 is a buffer underwrite (buffer underflow) vulnerability, classified under CWE-124, affecting the administrative interface of multiple Fortinet products. It impacts FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.6, 6.4.0 through 6.4.11, and 6.2.12 and below; FortiProxy versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, and 2.0.12 and below; and FortiOS-6K7K versions 7.0.5, 6.4.0 through 6.4.10, and 6.2.0 through 6.2.10 and below.
A remote unauthenticated attacker can exploit this vulnerability by sending specifically crafted requests to the administrative interface, potentially achieving execution of arbitrary code or commands. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical severity due to its network accessibility, low complexity, lack of required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation details are provided in the Fortinet PSIRT advisory at https://fortiguard.com/psirt/FG-IR-23-001.
Details
- CWE(s)