High severity · published Nov 14, 2023
CVE-2023-26205
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortiadc · Fortinet
6.1.0 through 6.1.6; 6.2.0 through 6.2.6; 7.0.0 through 7.0.5; 7.1.0; 7.1.1; 7.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26205
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26205
Vendor Advisory
https://fortiguard.com/psirt/FG-IR-22-292
More from Fortiadc
4.3
CVE-2018-13374
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
9.8
CVE-2022-38381
An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0…
9.1
CVE-2023-25603
A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized…
8.8
CVE-2022-35849
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0…
8.8
CVE-2022-39947
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through…