---
id: CVE-2023-29180
title: >-
  A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through
  7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS
  6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through
  7.2.3, For…
summary: >-
  A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through
  7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS
  6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through
  7.2.3, For…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:U/RC:C'
cvssSource: cna
cwe:
  - CWE-476
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS >= 7.2.0 <= 7.2.4
  - FortiOS >= 7.0.0 <= 7.0.11
  - FortiOS >= 6.4.0 <= 6.4.12
  - FortiOS >= 6.2.0 <= 6.2.14
  - FortiOS >= 6.0.0 <= 6.0.16
  - FortiProxy >= 7.2.0 <= 7.2.3
  - FortiProxy >= 7.0.0 <= 7.0.10
  - FortiProxy >= 2.0.0 <= 2.0.12
  - FortiProxy >= 1.2.1 <= 1.2.13
  - FortiProxy 01.02.00
  - FortiProxy >= 1.1.4 <= 1.1.6
  - FortiProxy >= 01.01.00 <= 01.01.03
  - FortiProxy >= 01.00.00 <= 01.00.07
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2024-08-14T19:10:11.418944Z'
published: '2024-02-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T13:48:27.871Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-29180'
references:
  - url: 'https://fortiguard.com/psirt/FG-IR-23-111'
    label: 'https://fortiguard.com/psirt/FG-IR-23-111'
tags:
  - cve.org
epss: 0.0261
epssPercentile: 0.85281
ingestedAt: '2026-10-22T22:00:50.273Z'
---

## Overview

A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0.0 through 2.0.12, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to denial of service via specially crafted HTTP requests.

## Affected

- `FortiOS >= 7.2.0 <= 7.2.4`
- `FortiOS >= 7.0.0 <= 7.0.11`
- `FortiOS >= 6.4.0 <= 6.4.12`
- `FortiOS >= 6.2.0 <= 6.2.14`
- `FortiOS >= 6.0.0 <= 6.0.16`
- `FortiProxy >= 7.2.0 <= 7.2.3`
- `FortiProxy >= 7.0.0 <= 7.0.10`
- `FortiProxy >= 2.0.0 <= 2.0.12`
- `FortiProxy >= 1.2.1 <= 1.2.13`
- `FortiProxy 01.02.00`
- `FortiProxy >= 1.1.4 <= 1.1.6`
- `FortiProxy >= 01.01.00 <= 01.01.03`
- `FortiProxy >= 01.00.00 <= 01.00.07`

## Remediation

Upgrade to FortiProxy version 7.2.4 or above
Upgrade to FortiProxy version 7.0.11 or above
Upgrade to FortiProxy version 2.0.13 or above
Upgrade to FortiOS version 7.4.0 or above
Upgrade to FortiOS version 7.2.5 or above
Upgrade to FortiOS version 7.0.12 or above
Upgrade to FortiOS version 6.4.13 or above
Upgrade to FortiOS version 6.2.15 or above
Upgrade to FortiOS version 6.0.17 or above