CVE-2023-37930: Use of uninitialized resource in SSLVPN websocket
First published: Tue Apr 08 2025(Updated: )
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities in Fortinet FortiOS SSL VPN webmode version 7.4.0, version 7.2.0 through 7.2.5, version 7.0.1 through 7.0.11 and version 6.4.7 through 6.4.14 and Fortinet FortiProxy SSL VPN webmode version 7.2.0 through 7.2.6 and version 7.0.0 through 7.0.12 allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiOS SSL VPN webmode | >=7.2.0<7.2.6>=7.0.1<7.0.12>=6.4.7<6.4.14 | |
| Fortinet FortiProxy SSL VPN webmode | >=7.2.0<7.2.6>=7.0.0<7.0.12 |
Remedy
Please upgrade to FortiOS version 7.4.1 or above Please upgrade to FortiOS version 7.2.6 or above Please upgrade to FortiOS version 7.0.13 or above Please upgrade to FortiOS version 6.4.15 or above Please upgrade to FortiOS version 6.4.14 or above Please upgrade to FortiProxy version 7.4.0 or above Please upgrade to FortiProxy version 7.2.7 or above Please upgrade to FortiProxy version 7.0.13 or above FortiSASE is no longer impacted, issue remediated Q3/23 ## Workaround: Disable SSLVPN webmode. Alternatively, please use SSLVPN tunnel mode, IPsec (tunnel) or ZTNA (web access). https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-SSL-VPN-Web-Mode-or-Tunnel-Mode-in/ta-p/217990 https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/45836/ssl-vpn-to-ipsec-vpn https://docs.fortinet.com/document/fortigate/7.2.3/administration-guide/78050/migrating-from-ssl-vpn-to-ztna
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-37930?
CVE-2023-37930 has been assigned a high severity rating due to its potential to allow unauthorized access and system compromise.
How do I fix CVE-2023-37930?
To fix CVE-2023-37930, users should upgrade FortiOS SSL VPN webmode to version 7.4.1 or later and FortiProxy SSL VPN webmode to version 7.2.6 or later.
Which versions are affected by CVE-2023-37930?
CVE-2023-37930 affects FortiOS SSL VPN webmode versions 6.4.7 to 6.4.14, 7.0.1 to 7.0.11, and 7.2.0 to 7.2.5, as well as FortiProxy SSL VPN webmode versions 7.0.0 to 7.0.12 and 7.2.0 to 7.2.6.
What vulnerabilities are included in CVE-2023-37930?
CVE-2023-37930 includes vulnerabilities such as the use of uninitialized resources and excessive iteration, which can be exploited for denial of service and data compromise.
Who is impacted by CVE-2023-37930?
Organizations using the affected versions of Fortinet FortiOS SSL VPN webmode and FortiProxy SSL VPN webmode are at risk due to CVE-2023-37930.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/type
- agent/author
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2023-37930
- collector/fortiguard-psirt
- agent/severity
- agent/title
- agent/references
- agent/source
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/fortinet
- canonical/fortinet fortios ssl vpn webmode
- canonical/fortinet fortiproxy ssl vpn webmode