---
id: CVE-2023-41677
title: >-
  A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0
  through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12,
  FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all
  versions…
summary: >-
  A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0
  through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12,
  FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all
  versions…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C'
cvssSource: cna
cwe:
  - CWE-522
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS >= 7.4.0 <= 7.4.1
  - FortiOS >= 7.2.0 <= 7.2.6
  - FortiOS >= 7.0.0 <= 7.0.12
  - FortiOS >= 6.4.0 <= 6.4.14
  - FortiOS >= 6.2.0 <= 6.2.15
  - FortiOS >= 6.0.0 <= 6.0.18
  - FortiProxy >= 7.4.0 <= 7.4.1
  - FortiProxy >= 7.2.0 <= 7.2.7
  - FortiProxy >= 7.0.0 <= 7.0.13
  - FortiProxy >= 2.0.0 <= 2.0.14
  - FortiProxy >= 1.2.1 <= 1.2.13
  - FortiProxy 01.02.00
  - FortiProxy >= 1.1.4 <= 1.1.6
  - FortiProxy >= 01.01.00 <= 01.01.03
  - FortiProxy >= 01.00.00 <= 01.00.07
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-04-11T04:01:14.917820Z'
published: '2024-04-09'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T13:48:33.264Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-41677'
references:
  - url: 'https://fortiguard.com/psirt/FG-IR-23-493'
    label: 'https://fortiguard.com/psirt/FG-IR-23-493'
tags:
  - cve.org
epss: 0.00753
epssPercentile: 0.54556
ingestedAt: '2026-10-22T22:00:50.274Z'
---

## Overview

A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.1, FortiProxy 7.2.0 through 7.2.7, FortiProxy 7.0.0 through 7.0.13, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via targeted social engineering attack

## Affected

- `FortiOS >= 7.4.0 <= 7.4.1`
- `FortiOS >= 7.2.0 <= 7.2.6`
- `FortiOS >= 7.0.0 <= 7.0.12`
- `FortiOS >= 6.4.0 <= 6.4.14`
- `FortiOS >= 6.2.0 <= 6.2.15`
- `FortiOS >= 6.0.0 <= 6.0.18`
- `FortiProxy >= 7.4.0 <= 7.4.1`
- `FortiProxy >= 7.2.0 <= 7.2.7`
- `FortiProxy >= 7.0.0 <= 7.0.13`
- `FortiProxy >= 2.0.0 <= 2.0.14`
- `FortiProxy >= 1.2.1 <= 1.2.13`
- `FortiProxy 01.02.00`
- `FortiProxy >= 1.1.4 <= 1.1.6`
- `FortiProxy >= 01.01.00 <= 01.01.03`
- `FortiProxy >= 01.00.00 <= 01.00.07`

## Remediation

Upgrade to FortiProxy version 7.4.2 or above
Upgrade to FortiProxy version 7.2.8 or above
Upgrade to FortiProxy version 7.0.14 or above
Upgrade to FortiOS version 7.4.2 or above
Upgrade to FortiOS version 7.2.7 or above
Upgrade to FortiOS version 7.0.13 or above
Upgrade to FortiOS version 6.4.15 or above
Upgrade to FortiOS version 6.2.16 or above