Headline
CVE-2022-43953: Fortiguard
A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.
** PSIRT Advisories**
FortiOS & FortiProxy - Format String Bug in fortiguard-resources CLI command
Summary
A format string vulnerability [CWE-134] in the command line interpreter of FortiOS and FortiProxy may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.
Affected Products
FortiOS version 7.2.0 through 7.2.4
FortiOS all versions 7.0, 6.4, 6.2
FortiProxy version 7.2.0 through 7.2.1
FortiProxy version 7.0.0 through 7.0.7
Solutions
Please upgrade to FortiProxy version 7.2.2 or above
Please upgrade to FortiProxy version 7.0.8 or above
Please upgrade to FortiOS version 7.4.0 or above
Please upgrade to FortiOS version 7.2.5 or above
Please upgrade to FortiOS version 7.0.12 or above
Please upgrade to FortiOS version 6.4.13 or above
Acknowledgement
Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.
Timeline
2023-06-09: Initial publication