FG-IR-23-460: Multiple buffer overflows in diag npu command
Published Jun 11, 2024
·Updated
Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the command line interpreter of FortiOS may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments.
Affected Software
6 affected componentsFixes available
Fortinet FortiOS>=7.4.0<=7.4.2
Fortinet FortiOS>=7.2.0<=7.2.6
Fortinet FortiOS>=7.0.0<=7.0.13
Fortinet FortiOS>=6.4.0<=6.4.14
Fortinet FortiOS>=6.2.0<=6.2.15
Fortinet FortiOS>=6.0
Event History
Jun 11, 2024
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-23-460?
The severity of FG-IR-23-460 is classified as high due to its potential to allow authenticated attackers to execute unauthorized code.
2
How do I fix FG-IR-23-460?
To fix FG-IR-23-460, update FortiOS to versions 7.4.3, 7.2.7, 7.0.14, 6.4.15, or 6.2.16 as applicable.
3
Which versions of FortiOS are affected by FG-IR-23-460?
FortiOS versions from 6.0 to 7.4.2 are affected by FG-IR-23-460.
4
Can FG-IR-23-460 be exploited remotely?
FG-IR-23-460 requires authenticated access to exploit the vulnerabilities.
5
What type of vulnerability is described in FG-IR-23-460?
FG-IR-23-460 describes multiple stack-based buffer overflow vulnerabilities affecting the command line interpreter in FortiOS.