CVE-2023-41678 HIGH

CVE-2023-41678

Vendor Fortinet

Product FortiOS

Weakness CWE-415

Published December 13, 2023

Last update February 25, 2026

View on NVD All CVEs

CVSS base score

8.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

What the vulnerability does

01Description

A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.

Key dates

02Disclosure timeline

December 13, 2023 CVE published

February 25, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-41678 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/415.html

Identifiers

CVE CVE-2023-41678

CWE CWE-415

CVSS 8.3 / HIGH

Affected versions

Vendor Fortinet

Product FortiOS

Affected ≥ 7.0.0 and ≤ 7.0.5

Vendor Fortinet

Product FortiPAM

Affected ≥ 1.1.0 and ≤ 1.1.1

Vendor Fortinet

Product FortiPAM

Affected ≥ 1.0.0 and ≤ 1.0.3