CVE-2023-40716: OS Command Injection

Published Dec 13, 2023

Updated

An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup .

Affected Software

35 affected components

Fortinet FortiTester=2.3.0

Fortinet FortiTester=2.4.0

Fortinet FortiTester=2.4.1

Fortinet FortiTester=2.5.0

Fortinet FortiTester=2.6.0

Fortinet FortiTester=2.7.0

Fortinet FortiTester=2.8.0

Fortinet FortiTester=2.9.0

Fortinet FortiTester=3.0.0

Fortinet FortiTester=3.1.0

Fortinet FortiTester=3.2.0

Fortinet FortiTester=3.3.0

Fortinet FortiTester=3.3.1

Fortinet FortiTester=3.4.0

Fortinet FortiTester=3.5.0

Fortinet FortiTester=3.5.1

Fortinet FortiTester=3.6.0

Fortinet FortiTester=3.7.0

Fortinet FortiTester=3.7.1

Fortinet FortiTester=3.8.0

Fortinet FortiTester=3.9.0

Fortinet FortiTester=3.9.1

Fortinet FortiTester=3.9.2

Fortinet FortiTester=4.0.0

Fortinet FortiTester=4.1.0

Fortinet FortiTester=4.1.1

Fortinet FortiTester=4.2.0

Fortinet FortiTester=4.2.1

Fortinet FortiTester=7.0.0

Fortinet FortiTester=7.1.0

Fortinet FortiTester=7.1.1

Fortinet FortiTester=7.2.0

Fortinet FortiTester=7.2.1

Fortinet FortiTester=7.2.2

Fortinet FortiTester=7.2.3

Remediation

Information

Please upgrade to FortiTester version 7.3.0 or above

Event History

Dec 13, 2023

CVE Published

06:44 AM

Data Sourced

06:44 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-40716?

CVE-2023-40716 is classified as a medium severity vulnerability that may allow authenticated attackers to execute unauthorized commands.

How do I fix CVE-2023-40716?

To fix CVE-2023-40716, update FortiTester to the latest version as recommended by Fortinet.

What systems are affected by CVE-2023-40716?

CVE-2023-40716 affects multiple versions of FortiTester, including versions from 2.3.0 to 7.2.3.

What type of vulnerability is CVE-2023-40716?

CVE-2023-40716 is categorized as an improper neutralization of special elements used in an OS command vulnerability.

Who can exploit CVE-2023-40716?

CVE-2023-40716 can be exploited by authenticated attackers who can craft specific arguments when executing restore or backup commands.