---
id: CVE-2023-45583
title: >-
  A use of externally-controlled format string vulnerability in Fortinet FortiOS
  7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all
  versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.0 all versions,
  F…
summary: >-
  A use of externally-controlled format string vulnerability in Fortinet FortiOS
  7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all
  versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.0 all versions,
  F…
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-134
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS 7.4.0
  - FortiOS >= 7.2.0 <= 7.2.5
  - FortiOS >= 7.0.0 <= 7.0.19
  - FortiOS >= 6.4.0 <= 6.4.16
  - FortiOS >= 6.2.0 <= 6.2.17
  - FortiProxy >= 7.2.0 <= 7.2.5
  - FortiProxy >= 7.0.0 <= 7.0.11
  - FortiProxy >= 2.0.0 <= 2.0.14
  - FortiProxy >= 1.2.1 <= 1.2.13
  - FortiProxy 01.02.00
  - FortiProxy >= 1.1.4 <= 1.1.6
  - FortiProxy >= 01.01.00 <= 01.01.03
  - FortiPAM 1.1.0
  - FortiPAM >= 1.0.0 <= 1.0.3
  - FortiSwitchManager >= 7.2.0 <= 7.2.2
  - FortiSwitchManager >= 7.0.0 <= 7.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-05-14T17:49:39.269934Z'
published: '2024-05-14'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T13:48:34.869Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-45583'
references:
  - url: 'https://fortiguard.com/psirt/FG-IR-23-137'
    label: 'https://fortiguard.com/psirt/FG-IR-23-137'
tags:
  - cve.org
epss: 0.00659
epssPercentile: 0.50915
ingestedAt: '2026-10-22T22:00:50.276Z'
---

## Overview

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiSwitchManager 7.2.0 through 7.2.2, FortiSwitchManager 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.

## Affected

- `FortiOS 7.4.0`
- `FortiOS >= 7.2.0 <= 7.2.5`
- `FortiOS >= 7.0.0 <= 7.0.19`
- `FortiOS >= 6.4.0 <= 6.4.16`
- `FortiOS >= 6.2.0 <= 6.2.17`
- `FortiProxy >= 7.2.0 <= 7.2.5`
- `FortiProxy >= 7.0.0 <= 7.0.11`
- `FortiProxy >= 2.0.0 <= 2.0.14`
- `FortiProxy >= 1.2.1 <= 1.2.13`
- `FortiProxy 01.02.00`
- `FortiProxy >= 1.1.4 <= 1.1.6`
- `FortiProxy >= 01.01.00 <= 01.01.03`
- `FortiPAM 1.1.0`
- `FortiPAM >= 1.0.0 <= 1.0.3`
- `FortiSwitchManager >= 7.2.0 <= 7.2.2`
- `FortiSwitchManager >= 7.0.0 <= 7.0.2`

## Remediation

Upgrade to FortiSwitchManager version 7.2.3 or above
Upgrade to FortiSwitchManager version 7.0.3 or above
Upgrade to FortiProxy version 7.2.6 or above
Upgrade to FortiProxy version 7.0.12 or above
Upgrade to FortiPAM version 1.1.1 or above
Upgrade to FortiOS version 7.4.1 or above
Upgrade to FortiOS version 7.2.6 or above