CVE-2023-45583 is a medium severity format string flaw in Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager, scored 6.7. It needs a privileged local user. Upgrade to the fixed releases listed in Fortinet advisory FG-IR-23-137. Some branches are affected in every version, so check your branch.
What's affected
Fortinet's advisory FG-IR-23-137, which also covers CVE-2023-36640, lists these products:
- FortiOS 7.4.0 (fixed in 7.4.1), 7.2.0 through 7.2.5 (fixed in 7.2.6), and 6.0.0 through 6.0.16. FortiOS 7.0, 6.4 and 6.2 are affected in all versions, so move to a fixed release.
- FortiPAM 1.1.0 (fixed in 1.1.1) and all of 1.0.
- FortiProxy 7.2.0 through 7.2.5 (fixed in 7.2.6), 7.0.0 through 7.0.11 (fixed in 7.0.12), and all of the 2.0, 1.2, 1.1 and 1.0 branches.
- FortiSwitchManager 7.2.0 through 7.2.2 (fixed in 7.2.3) and 7.0.0 through 7.0.2 (fixed in 7.0.3).
The advisory says FortiSASE was remediated in Q3 2023 and that a virtual patch exists in the FMWP database update 23.103. The record and advisory agree on severity: medium, 6.7, vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
On a FortiOS or FortiProxy device, the command line shows the running version:
get system status
Match the version and product against the list above. For devices on the 7.0, 6.4 or 6.2 branches of FortiOS, every version is affected, so the answer is a branch migration, not a point release.
Fortinet recommends using its upgrade path tool to plan the route between releases.
What to do now
- Run get system status on each Fortinet device and record product and version.
- Upgrade to the fixed release for your branch, or plan a branch migration where all versions are affected.
- Limit CLI and administrative access to a small set of named accounts, since the flaw needs high privileges.
- Review the virtual patch note in the advisory if an upgrade has to wait.
- Keep a list of Fortinet devices with owners and maintenance windows.
Why it matters
A format string flaw, CWE-134, happens when untrusted input is passed where a program expects a fixed formatting template. The formatting routine can then read or write memory in ways the author did not intend. The NVD description says specially crafted CLI commands and HTTP requests can lead to unauthorized code or commands.
The score is held to medium because the vector needs high privileges and local access. That does not make it harmless. Network appliances sit at the edge, and an attacker who already has an administrator account can use a bug like this to move from managed access to full control of the device.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report exploitation.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Which FortiOS release fixes this?
7.4.1 for the 7.4 branch and 7.2.6 for the 7.2 branch. Older branches need migration to a fixed release.
Is there a virtual patch?
The advisory names one in FMWP database update 23.103, for the FortiOS HTTPS daemon format string issue.
Sources
Last reviewed: 19 October 2026.
