Fortinet Security Updates – 07 May 2023

The addressed vulnerabilities could allow the attacker to gain access, execute code, disclose information, or trigger cross-site scripting attacks on the affected products.

Sample of the addressed vulnerabilities:

1. FortiADC – Command Injection Vulnerability in External Resource Module (CVE-2023-27999):

• CVSS: 7.6
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

2. FortiOS & FortiProxy – Out-of-bound-write in sslvpnd (CVE-2023-22640):

• CVSS: 7.1
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Access

Affected Products:

• FortiNAC.
• FortiADC.
• FortiOS.
• FortiProxy.