VYPR
← All advisories
Medium severity5.0NVD Advisory· Published May 14, 2024· Updated Jun 17, 2026

CVE-2023-45586

CVE-2023-45586

Description

An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.

Affected products

10
  • Fortinet/Fortiproxy4 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: >=2.0.0,<=2.0.12
    • cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*
    • (no CPE)range: 7.4.0
  • Fortinet/Fortios4 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=6.2.0,<=6.2.16
    • cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*
    • (no CPE)range: 7.4.0
  • Fortinet/FortiOS SSL VPNllm-fuzzy
    Range: 7.4.0-7.4.1, 7.2.0-7.2.7, <7.0.12
  • Fortinet/FortiProxy SSL-VPNllm-fuzzy
    Range: 7.4.0-7.4.1, 7.2.0-7.2.7, <7.0.13

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.