CVE-2023-40720 is a high severity authorization bypass in FortiVoice Enterprise. NVD scores it 7.1. An authenticated attacker can read other users' SIP configuration through crafted HTTP or HTTPS requests. Fortinet fixes it in 7.0.2 and 6.4.9 or later, and tells 6.0 users to migrate.
What's affected
Fortinet's advisory FG-IR-23-282, published on 14 May 2024, lists these versions:
- FortiVoice 7.0: 7.0.0 through 7.0.1. Upgrade to 7.0.2 or above.
- FortiVoice 6.4: 6.4.0 through 6.4.8. Upgrade to 6.4.9 or above.
- FortiVoice 6.0: all versions. Migrate to a fixed release.
The weakness is CWE-639, authorization bypass through a user-controlled key. NVD spells the product FortiVoiceEntreprise in its description, which is a typo for FortiVoice Enterprise.
Severity conflict. NVD scores the flaw 7.1 (High) with a vector that needs only a low-privilege account. Fortinet's advisory shows the same CVSS v3 score of 7.1, with a temporal score of 6.7, but labels the severity Medium. Both appear in the sources. Treat 7.1 as the score and read Fortinet's label as its own prioritisation.
Fortinet says the issue was discovered internally and reports Known Exploited as No. It is not in CISA's KEV catalog either.
How to check if you're exposed
Check the firmware version on each FortiVoice Enterprise unit. The web console shows the system version, and Fortinet's documentation for your release describes the command line check.
Compare the version against the lists above. Anything in 7.0.0 to 7.0.1 or 6.4.0 to 6.4.8, or anything on the 6.0 line, needs action. Also count who has authenticated access. The attack needs a valid account, so extensions, admins and any delegated user count toward your exposure.
What to do now
- List every FortiVoice Enterprise unit with its firmware version.
- Upgrade 7.0 units to 7.0.2 or later and 6.4 units to 6.4.9 or later, following Fortinet's upgrade path notes.
- Plan a migration for any 6.0 units, since Fortinet lists no fix inside that line.
- Restrict the management and user web interface to trusted networks while you schedule upgrades.
- After upgrading, consider rotating SIP credentials for any account where the configuration could have been read.
Why it matters
This is an insecure direct object reference pattern. The request includes an identifier for a record, and the server returns the record without checking that the caller owns it. Changing the identifier is enough to see someone else's data, which is why the weakness is called a user-controlled key.
SIP configuration can hold credentials and routing details for phone extensions. Reading it is rated high for confidentiality and low for availability. A telephony system is easy to forget in vulnerability programs, so the fix may need a separate owner and change window.
Quick check
Do I need an account to exploit this?
Yes. Fortinet lists it as an authenticated attack, and the vector requires low privileges.
Which release fixes it?
7.0.2 or above for the 7.0 line and 6.4.9 or above for 6.4. Version 6.0 has no fix listed, so migrate.
Sources
Last reviewed: 19 October 2026.
