CVE-2023-46714: 
FortiOS vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability (CVE-2023-46714) was discovered in the FortiOS administrative interface. The vulnerability affects FortiOS versions 7.4.0 through 7.4.1 and 7.2.1 through 7.2.7. This security issue was internally discovered and reported by Théo Leleu of the Fortinet Product Security team, with initial publication on May 14, 2024 (Fortiguard PSIRT).

The vulnerability is classified as a stack-based buffer overflow [CWE-121] in the FortiOS administrative interface GUI component. It has been assigned a CVSSv3 score of 6.8, categorizing it as a medium severity issue. The vulnerability can be exploited through crafted HTTP or HTTPs requests to the administrative interface (Fortiguard PSIRT).

If successfully exploited, this vulnerability allows a privileged attacker to execute arbitrary code or commands on the affected system via the administrative interface (Fortiguard PSIRT).

The vulnerability requires privileged access to the administrative interface to be exploited. No public exploits or active exploitation in the wild have been reported at the time of disclosure (Fortiguard PSIRT).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade FortiOS 7.4.x to version 7.4.2 or above, and FortiOS 7.2.x to version 7.2.8 or above. Additionally, a virtual patch named 'FG-VD-54575.0day' is available in FMWP db update 24.011. Users can follow the recommended upgrade path using Fortinet's upgrade tool (Fortiguard PSIRT).