CVE-2023-41675

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.10
Fortinet	FortiProxy	>= 7.2.0, <= 7.2.2; >= 7.0.0, <= 7.0.8
fortinet	fortios	>= 7.2.0, <= 7.2.4; >= 7.0.0, <= 7.0.10
fortinet	fortiproxy	>= 7.2.0, <= 7.2.2; >= 7.0.0, <= 7.0.8

References

https://fortiguard.com/psirt/FG-IR-23-184Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-184Vendor Advisory

Timeline

Published: Oct 10, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-416766.5An exposure of sensitive information to an unauthorized actor [CWE-200] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker w CVE-2023-416778.8A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 thr CVE-2023-416788.8A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to CVE-2023-416799.6An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 thro CVE-2023-41687.5A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the CVE-2023-416806.1A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through CVE-2023-416816.1A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through CVE-2023-416827.5A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox CVE-2023-416835.4Missing Authorization vulnerability in Pechenki TelSender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue CVE-2023-416848.8Cross-Site Request Forgery (CSRF) vulnerability in Felix Welberg SIS Handball plugin <= 1.0.45 versions.CVE-2023-416859.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System all CVE-2023-416866.5Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects W