CVE-2023-41678

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.0.0 through 7.0.5 FortiPAM versions 1.0.0 through 1.0.3 FortiPAM versions 1.1.0 through 1.1.1

Description A double free in Fortinet FortiOS and FortiPAM allows an attacker to execute unauthorized code or commands via a specifically crafted request. This issue affects the HTTPSd daemon and can be exploited by an authenticated attacker to achieve arbitrary code execution.

Recommendations For Fortinet FortiOS versions 7.0.0 through 7.0.5, update to a version that contains a fix for this issue. For FortiPAM versions 1.0.0 through 1.0.3, update to a version that contains a fix for this issue. For FortiPAM versions 1.1.0 through 1.1.1, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the HTTPSd daemon to minimize the risk of exploitation.