CVE-2023-41677 is a high severity (CVSS 7.5) insufficiently protected credentials flaw in Fortinet FortiOS and FortiProxy. Under rare conditions an attacker could obtain the administrator cookie by luring an administrator to a malicious site through the SSL-VPN. Fortinet says upgrade, for example to FortiOS 7.4.2 or 7.2.7.
What's affected
Fortinet advisory FG-IR-23-493 lists these affected branches and fixes:
- FortiOS 7.4.0 through 7.4.1: upgrade to 7.4.2 or above
- FortiOS 7.2.0 through 7.2.6: upgrade to 7.2.7 or above
- FortiOS 7.0.0 through 7.0.12: upgrade to 7.0.13 or above
- FortiOS 6.4.0 through 6.4.14: upgrade to 6.4.15 or above
- FortiOS 6.2.0 through 6.2.15: upgrade to 6.2.16 or above
- FortiOS 6.0: all versions, migrate to a fixed release
- FortiProxy 7.4.0 through 7.4.1: upgrade to 7.4.2 or above
- FortiProxy 7.2.0 through 7.2.7: upgrade to 7.2.8 or above
- FortiProxy 7.0.0 through 7.0.13: upgrade to 7.0.14 or above
- FortiProxy 2.0, 1.2, 1.1 and 1.0: all versions, migrate to a fixed release
The advisory lists the component as SSL-VPN, and says it is not known to be exploited.
The record scores the flaw 7.5 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. It can be reached over the network, the attack complexity is high, it requires no privileges, and it needs a user to take part (for example by opening or visiting something). The impact on confidentiality is high, on integrity high and on availability high. The weakness class is CWE-522 (insufficiently protected credentials). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
Source conflict: the NVD record lists FortiProxy 7.2.0 through 7.2.6 and 7.0.0 through 7.0.12, while the Fortinet advisory (updated 2024-06-06) lists 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13. Use the Fortinet ranges, which are wider. Both sources give the severity as High with a score of 7.5.
How to check if you're exposed
On a FortiGate or FortiProxy, sign in to the CLI and run:
get system status
The output includes the firmware version. Compare it with the branches above. The issue concerns the SSL-VPN component, so also check whether SSL-VPN is enabled and who can reach it. Fortinet's upgrade path tool at https://docs.fortinet.com/upgrade-tool helps you pick a safe route between releases.
What to do now
- Read the version with
get system statuson each device. - Upgrade to the fixed release for your branch, using the Fortinet upgrade path tool.
- Move off FortiOS 6.0 and FortiProxy 1.x and 2.0, which have no fixed release on those branches.
- Tell administrators not to browse other sites while signed in to the admin interface.
- Restrict who can reach the SSL-VPN and the admin interface.
Why it matters
The weakness is CWE-522, insufficiently protected credentials. Here the credential is the administrator session cookie, which Fortinet says could be obtained in rare and specific conditions by tricking the administrator into visiting a malicious site through the SSL-VPN. That is why the vector lists high attack complexity and required user interaction.
The score is still 7.5 because a stolen admin cookie gives full control. Fortinet says it was found internally and is not known to be exploited. The record does not list it in the CISA KEV catalog either.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2023-41677 exploited in the wild?
Fortinet lists Known Exploited as No, and the record has the KEV flag set to false.
What if I run FortiOS 6.0?
Fortinet says all FortiOS 6.0 versions are affected and tells you to migrate to a fixed release.
Sources
Last reviewed: 19 October 2026.
