CVE-2023-44247
Published May 14, 2024
CVSS 3.1 · 6.5 Medium
EPSS 1.3%
KEV · Not listed
Description
A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Fortinet | FortiOS | unaffected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
Vendor Solution
Upgrade to FortiOS version 7.0.0 or above
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-48606 | A double free vulnerability [CWE-415] in Fortinet FortiOS before 7.0.0 may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests. |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required High
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 1.3% (1.258% probability within 30 days)
Exploitation none
Automatable no
Technical Impact total
References
| Link | Providers |
|---|---|
| https://fortiguard.com/psirt/FG-IR-23-195 |
|
History
Dec 19, 2025 9:15 AM
Affected versions updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:* | |
| Metrics |
ssvc
|
Dec 19, 2025 9:00 AM
Description updated. Affected versions updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A double free vulnerability [CWE-415] in Fortinet FortiOS before 7.0.0 may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests. | A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests. |
| CPEs | cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:* |
Weaknesses
