9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.135 Low
EPSS
Percentile
95.6%
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
Recent assessments:
mikecybersecaspire at June 13, 2023 7:22am UTC reported:
This vulnerability is expected to be of very high value as Fortigate SSL VPN vulnerabilities have been exploited in the past, particurlarly by state sponsored or otherwise-motivated IAB actors. Fortinet also predict that whilst there isnβt an official link to Volt Typhoon, they do expect the majority of TAβs exploiting this vulnerability, Volt Typhoon have been known to exploit prior Fortigate SSL VPN vulns as part of their initial access campaign.
Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 3
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.135 Low
EPSS
Percentile
95.6%