CVE-2023-45586

5.0 mediumEPSS 0.3%

Medium (5.0) in fortinet. EPSS 0.3% chance of exploitation in the next 30 days.

An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.

Severity

CVSS 3.1

5.0 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-345
Published: 2024-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortios
fortinet:fortiproxy

References

https://fortiguard.com/psirt/FG-IR-23-225
https://fortiguard.com/psirt/FG-IR-23-225

Check your stack JSON