External risk intelligence

Fortinet FortiOS and FortiProxy Out-of-Bounds Write Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-42789

This vulnerability affects Fortinet FortiOS and FortiProxy, which are network security appliances commonly deployed as internet-facing edge gateways, VPN concentrators, and firewalls. By design, these products are intended to reside at the perimeter of a network to manage traffic and provide remote access, making them highly likely to be reachable from the public internet in normal deployments.

Out-of-bounds Write

Fortinet Fortiproxy

2.0.0 to 2.0.137.0.0 to 7.0.127.2.0 to 7.2.67.4.06.2.0 to 6.2.156.4.0 to 6.4.147.2.0 to 7.2.57.4.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory describes a critical security vulnerability affecting Fortinet network devices that could allow an attacker to execute unauthorized code or commands. The issue stems from an out-of-bounds write, which is a common type of memory corruption flaw. While the specific impact depends on the device's role and configuration, such vulnerabilities can lead to significant compromise if exploited. The primary concern is to confirm if your organization uses the affected technology and assess potential exposure.

Flaw lets attackers run harmful code remotely.
It affects widely used Fortinet network devices.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HTTP requests to an internet-exposed Fortinet device. This could allow them to execute arbitrary code or commands on the affected system, potentially leading to a full compromise.

Exposed to the network.
Crafted HTTP requests.
Unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests to the affected devices. When this occurs, it could lead to a compromise of the device's integrity and confidentiality.

Network access to the device.
Specially crafted HTTP requests.
Unauthorized code execution and command control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Fortinet FortiOS and FortiProxy devices, likely managed by network or security operations teams. The initial step is to identify all instances of the affected technology, determine their exposure and criticality, and then engage the accountable owners for remediation planning.

Network and security teams own this issue.
Verify internet-facing or critical exposure.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FortiOS and FortiProxy?

FortiOS is the core operating system powering Fortinet's security hardware, such as firewalls and VPN concentrators, while FortiProxy provides web security and caching services. These tools act as the gatekeepers for enterprise networks, managing traffic flow and protecting internal resources from external threats. Organizations rely on them to secure the network edge, making them fundamental to maintaining organizational connectivity and perimeter defense.

How does an out-of-bounds write affect CVE-2023-42789?

This vulnerability is classified as CWE-787, which occurs when a program writes data past the intended boundary of a memory buffer. In the context of CVE-2023-42789, this memory corruption allows an attacker to overwrite adjacent data or code in the system's memory. This typically enables the attacker to manipulate the program's behavior, potentially executing unauthorized commands or taking control of the affected device.

Do I need to be authenticated to trigger CVE-2023-42789?

No, this vulnerability does not require authentication. An attacker can trigger the issue by sending a specially crafted HTTP request to the target device. It is important to note that sending standard, legitimate HTTP traffic does not trigger this flaw; the request must be intentionally malformed to manipulate memory during processing.

Why is this vulnerability a priority for network edge devices?

Halo Surface Signal notes that Fortinet appliances are frequently deployed as internet-facing gateways. Because these devices are designed to sit at the network perimeter to manage incoming traffic, they are directly reachable from the public internet. This design choice inherently increases the risk, as any unauthenticated attacker on the internet can potentially reach the vulnerable HTTP interface without needing to bypass internal network defenses.

What is the first step to address this CVE?

Start by identifying all instances of FortiOS and FortiProxy within your environment. Since these devices are often central to network infrastructure, inventorying their versions is critical to see if they fall within the range of affected releases. Once you have a complete list, prioritize devices based on their role and network exposure, and coordinate with the teams responsible for these systems to plan for software updates.

References

fortiguard.com/psirt/FG-IR-23-328

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.