{"id":"CVE-2023-41678","state":"PUBLISHED","title":"A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands v","description":"A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.","publishedAt":"2023-12-13T06:44:44.233Z","updatedAt":"2026-02-25T16:12:50.580Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiOS","Fortinet FortiPAM"],"affected":[{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiPAM","defaultStatus":"unaffected","versions":[{"version":"1.1.0","status":"affected","lessThanOrEqual":"1.1.1","versionType":"semver"},{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.0.3","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-23-196"],"weaknesses":["CWE-415"],"ingestedAt":"2026-10-29T20:06:17.512Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/41xxx/CVE-2023-41678.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-41678","state":"PUBLISHED","datePublished":"2023-12-13T06:44:44.233Z","dateUpdated":"2026-02-25T16:12:50.580Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2023-08-30T13:42:39.547Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request."}],"affected":[{"vendor":"Fortinet","product":"FortiOS","defaultStatus":"unaffected","versions":[{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiPAM","defaultStatus":"unaffected","versions":[{"version":"1.1.0","status":"affected","lessThanOrEqual":"1.1.1","versionType":"semver"},{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.0.3","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-196","name":"https://fortiguard.com/psirt/FG-IR-23-196"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-415","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-12-13T06:44:44.233Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiOS version 7.2.0 or above \nPlease upgrade to FortiOS version 7.0.6 or above \nPlease upgrade to FortiOS version 6.4.15 or above \nPlease upgrade to FortiPAM version 1.2.0 or above \nPlease upgrade to FortiPAM version 1.1.2 or above \n"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-196","name":"https://fortiguard.com/psirt/FG-IR-23-196","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T19:01:35.327Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-41678","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2023-12-14T05:00:10.853716Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-25T16:12:50.580Z"}}]}}}