FG-IR-23-165: Use of uninitialized resource in SSLVPN websocket
Multiple potential issues, including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] in FortiOS & FortiProxy SSLVPN webmode may allow a VPN user to corrupt memory, potentially leading to code or commands execution via specifically crafted requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-165?
The severity of FG-IR-23-165 is critical due to the potential for memory corruption and code execution.
How do I fix FG-IR-23-165?
To fix FG-IR-23-165, update FortiOS and FortiProxy to the latest versions provided by Fortinet.
Who is affected by FG-IR-23-165?
Organizations using FortiOS or FortiProxy SSLVPN in web mode are potentially affected by FG-IR-23-165.
What are the exploit vectors for FG-IR-23-165?
Exploitation of FG-IR-23-165 can occur through specifically crafted requests by a VPN user.
What vulnerabilities are associated with FG-IR-23-165?
FG-IR-23-165 includes vulnerabilities related to uninitialized resources (CWE-908) and excessive iteration (CWE-834).