CVE-2023-26205: High severity Fortinet FortiADC vulnerability

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2023-26205.

Q: What is the severity of CVE-2023-26205?

The severity of CVE-2023-26205 is high with a score of 8.1.

Q: Which software versions are affected by this vulnerability?

FortiADC automation feature versions 7.1.0 through 7.1.2, 7.0, 6.2, and 6.1 are affected.

Q: How can an attacker exploit this vulnerability?

An authenticated low-privileged attacker can escalate their privileges to super_admin via a specifically crafted configuration of fabric authentication users and groups.

Q: Is there a patch available for this vulnerability?

It is recommended to update to the latest version of FortiADC that addresses this vulnerability.

Published Nov 14, 2023

Updated

An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to superadmin via a specific crafted configuration of fabric automation CLI script.

Affected Software

6 affected components

Fortinet FortiADC>=6.1.0<=6.1.6

Fortinet FortiADC>=6.2.0<=6.2.6

Fortinet FortiADC>=7.0.0<=7.0.5

Fortinet FortiADC=7.1.0

Fortinet FortiADC=7.1.1

Fortinet FortiADC=7.1.2

Remediation

Information

Please upgrade to FortiADC version 7.2.0 or above Please upgrade to FortiADC version 7.1.3 or above

Event History

Nov 14, 2023

CVE Published

06:05 PM

Data Sourced

06:05 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2023-26205.

What is the severity of CVE-2023-26205?

The severity of CVE-2023-26205 is high with a score of 8.1.

Which software versions are affected by this vulnerability?