CVE-2023-40721

moderate-risk

Published 2025-02-11

A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.7/10 Medium

LOCAL / LOW complexity

Affected Products (6)

Fortios

Fortiswitchmanager

Fortiproxy

Fortipam

Affected Vendors

Fortinet

References (1)

Vendor Advisory https://fortiguard.com/psirt/FG-IR-23-261

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 13/34 · Low