Fortinet Patches Critical FortiOS Vulnerability Leading to Remote Code Execution
12-Jul-23
On Tuesday, Fortinet released security upgrades to fix a serious vulnerability in FortiOS and FortiProxy that may be used to execute code remotely (RCE). The bug is identified as CVE-2023-33308 and is a stack-based overflow problem that affects the deep inspection function in proxy mode. It has a CVSS score of 9.8.
According to a Fortinet advisory, “FortiOS & FortiProxy stack-based overflow vulnerability may allow a remote attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.” Disabling the feature avoids exploitation because the problem only arises when deep inspection is enabled on proxy rules or firewall policies with proxy mode, according to the cybersecurity company.
