CVE-2023-33305: 
FortiOS vulnerability analysis and mitigation

A loop with unreachable exit condition ('Infinite Loop') vulnerability was discovered in multiple Fortinet products, identified as CVE-2023-33305. The vulnerability was internally discovered by Gwendal Guégniaud of Fortinet Product Security team and publicly disclosed on June 12, 2023. The affected products include multiple versions of FortiOS (6.0-7.2.4), FortiProxy (1.0-7.2.3), and FortiWeb (6.3-7.2.1) (Fortinet Advisory).

The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition) and received a CVSS v3.1 base score of 4.9 (Medium severity). The vulnerability exists in the firmware upgrade function of the affected products, where an infinite loop condition can be triggered through specially crafted firmware images. The attack requires authentication and can be executed remotely (NVD, Fortinet Advisory).

When successfully exploited, the vulnerability allows an authenticated attacker to perform a denial of service attack against the affected system. This can result in the system becoming unresponsive or unavailable for its intended purpose (Fortinet Advisory).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade to the following versions: FortiWeb version 7.2.2 or above, FortiWeb version 7.0.7 or above, FortiOS version 7.4.0 or above, FortiOS version 7.2.5 or above, FortiOS version 7.0.11 or above, FortiProxy version 7.2.4 or above, or FortiProxy version 7.0.10 or above (Fortinet Advisory).