# Fortinet FortiOS, FortiProxy heap buffer underflow RCE

Published: 2023-04-11 · Severity: elevated · Sectors: defense, government-national, infrastructure, technology
Canonical: https://vorant.io/reports/68035c05-02f9-55fa-b550-a20bab53edb5/fortinet-fortios-fortiproxy-heap-buffer-underflow-rce

> Heap buffer underflow in FortiOS and FortiProxy allows unauthenticated remote code execution and denial of service.

Fortinet has disclosed a heap-based buffer underflow vulnerability affecting FortiOS and FortiProxy products. An unauthenticated attacker can send a crafted request to trigger the flaw, achieving arbitrary code execution or denying service. The vulnerability affects multiple versions across both product lines; certain hardware platforms are not vulnerable to remote code execution, though all affected versions can experience denial of service. IPA (Japan's Information-technology Promotion Agency) issued this alert on 9 March 2023, with updates through 14 April 2023 clarifying affected hardware and available patches. Fortinet released fixed versions and mitigation strategies; defenders should prioritize immediate patching or apply recommended workarounds to limit exposure.

## Mentioned in this report

- Vulnerabilities: CVE-2023-25610

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2022/alert20230309.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/68035c05-02f9-55fa-b550-a20bab53edb5/fortinet-fortios-fortiproxy-heap-buffer-underflow-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup