CVE-2023-47537CWE-295

An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS…

Medium · published February 15, 2024

CVSS v3.1
4.4
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-02-15T13:59Z
EPSS history
Timeline
  • 15 FEB 13:59Z
    An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS…
    cvelistv5