Security readout for executives and security teams
Plain-English summary
This Fortinet flaw can let an unauthenticated remote attacker run unauthorized code or commands by sending specially crafted HTTP requests. It affects several FortiOS, FortiProxy, and FortiSASE versions. Treat it as high priority, especially for internet-reachable appliances, but the provided sources do not show confirmed active exploitation.
Executive priority
Prioritize this in the next remediation cycle for any exposed Fortinet edge or proxy systems. The business risk is unauthorized code execution on security infrastructure, but current provided evidence does not prove active exploitation.
Technical view
CVE-2023-42790 is a stack-based buffer overflow (CWE-121) in Fortinet products. CVSS v3.1 is 7.7 with network attack vector, no privileges, no user interaction, high impact to confidentiality, integrity, and availability, and high attack complexity.
Likely exposure
Organizations running affected FortiOS 7.4.0-7.4.1, 7.2.0-7.2.5, 7.0.0-7.0.12, 6.4.0-6.4.14, 6.2.0-6.2.15; affected FortiProxy releases; or FortiSASE 23.2.b may be exposed.
Exploitation context
The source bundle says exploitation uses specially crafted HTTP requests and CVSS marks exploit code maturity as proof-of-concept. CISA KEV status is false, and no cited source in the bundle confirms active exploitation.
Researcher notes
The evidence supports unauthenticated network reachability, HTTP-triggered attack surface, high impact, and high attack complexity. The bundle does not include exploit details, indicators of compromise, or exact fixed versions beyond pointing to Fortinet’s advisory.
Mitigation direction
- Check Fortinet FG-IR-23-328 for fixed versions and vendor-supported guidance.
- Upgrade affected FortiOS, FortiProxy, and FortiSASE deployments per Fortinet guidance.
- Prioritize remediation for internet-reachable or high-trust network appliances.
- Reduce unnecessary HTTP exposure while validating vendor remediation options.
Validation and detection
- Inventory FortiOS, FortiProxy, and FortiSASE versions against the affected ranges.
- Confirm whether exposed HTTP services map to affected Fortinet products.
- Review Fortinet advisory FG-IR-23-328 for the exact fixed release path.
- Document assets confirmed unaffected because they run versions outside listed ranges.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-42790 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C2.25.9fortinetVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/psirt/FG-IR-23-328CVE reference, fortinet
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.