CVE-2022-43953
First published: Tue Jun 13 2023(Updated: )
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiProxy | >=7.0.0<=7.0.7 | |
| Fortinet FortiProxy | =7.2.0 | |
| Fortinet FortiProxy | =7.2.1 | |
| Fortinet FortiOS | >=6.2.0<=6.2.15 | |
| Fortinet FortiOS | >=6.4.0<=6.4.12 | |
| Fortinet FortiOS | >=7.0.0<=7.0.11 | |
| Fortinet FortiOS | >=7.2.0<=7.2.4 |
Remedy
Please upgrade to FortiProxy version 7.2.2 or above Please upgrade to FortiProxy version 7.0.8 or above Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-43953?
CVE-2022-43953 is a vulnerability that allows an attacker to execute unauthorized code or cause a denial of service through a use of externally-controlled format string in Fortinet FortiOS and FortiProxy.
Which versions of Fortinet FortiOS are affected by CVE-2022-43953?
Fortinet FortiOS versions 7.2.0 through 7.2.4, all versions 7.0, all versions 6.4, and all versions 6.2 are affected by CVE-2022-43953.
Which versions of FortiProxy are affected by CVE-2022-43953?
FortiProxy versions 7.2.0 through 7.2.1 and versions 7.0.0 through 7.0.7 are affected by CVE-2022-43953.
What is the severity rating of CVE-2022-43953?
CVE-2022-43953 has a severity rating of 7.8 (High).
How can the CVE-2022-43953 vulnerability be exploited?
An attacker can exploit the CVE-2022-43953 vulnerability by using an externally-controlled format string to execute unauthorized code or cause a denial of service.
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/event
- agent/tags
- agent/first-publish-date
- vendor/fortinet
- canonical/fortinet fortiproxy
- version/fortinet fortiproxy/7.0.0
- version/fortinet fortiproxy/7.0.7
- version/fortinet fortiproxy/7.2.0
- version/fortinet fortiproxy/7.2.1
- canonical/fortinet fortios
- version/fortinet fortios/6.2.0
- version/fortinet fortios/6.2.15
- version/fortinet fortios/6.4.0
- version/fortinet fortios/6.4.12
- version/fortinet fortios/7.0.0
- version/fortinet fortios/7.0.11
- version/fortinet fortios/7.2.0
- version/fortinet fortios/7.2.4