CVE-2023-46720 is a medium severity (CVSS 6.7) stack-based buffer overflow in the FortiOS command line, reached through specially crafted CLI commands. It spans several branches from 6.0 to 7.4. Upgrade to 7.4.4, 7.2.8 or 7.0.16 or later, and migrate off 6.4, 6.2 and 6.0.
What's affected
Fortinet advisory FG-IR-23-356 lists FortiOS 7.4.0 through 7.4.3 (fix 7.4.4 or above), 7.2.0 through 7.2.7 (fix 7.2.8 or above) and 7.0.0 through 7.0.15 (fix 7.0.16 or above). FortiOS 6.4, 6.2 and 6.0 are listed as all versions affected, with advice to migrate to a fixed release.
The NVD record gives narrower ranges: 7.4.0 through 7.4.1, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.6 through 6.4.15, 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18. The advisory is broader, so follow it. Both score 6.7 Medium. The record assigns CWE-121 and CWE-787. No workaround is listed, and the advisory says it is not known to be exploited.
The NVD record scores it 6.7 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-121 (stack-based buffer overflow), CWE-787 (out-of-bounds write). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
On the device, run:
get system status
Compare the Version line with the ranges above. Then list the accounts that have CLI access, since the vector needs local access and high privileges.
What to do now
- Upgrade to 7.4.4, 7.2.8 or 7.0.16 or later, using Fortinet's upgrade path tool.
- Plan a migration for any device still on 6.4, 6.2 or 6.0.
- Limit who has CLI and administrator access, and remove unused accounts.
- Restrict management interfaces to trusted hosts.
- Keep a record of FortiOS versions across your estate.
Why it matters
A stack overflow in a command handler means a long or malformed argument can overwrite memory on the stack. Because it needs an authenticated, privileged CLI session, it is mostly relevant as a way to turn administrator access into code execution on the underlying system, bypassing restrictions.
The breadth of affected branches is the practical issue. Older branches need migration, not a patch, which takes planning.
Try it yourself
Not every branch gets a patch. This demo shows how to find where a fix is available now and where a move is needed.
Click through it at your own pace, or open it full screen.
Quick check
Do 6.x branches get a patch?
Fortinet says migrate to a fixed release.
Does the attacker need to be logged in?
Yes. The vector needs high privileges and local access.
Sources
Last reviewed: 19 October 2026.
