Vulnerability

CVE-2023-47534

Critical· 9.6CVSS9.6EPSS1%

.rules3/5

A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.

Threat signal

96/100

Severe

Severity

critical

CVSS

9.6

EPSS

Active

CVSS

v3.1via NVDOpen in FIRST calculator →

9.6/ 10CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack VectorNetworkExploitable remotely over the internet — no local access needed.
Attack ComplexityLowNo special conditions — exploit works reliably.
Privileges RequiredNoneUnauthenticated — no credentials needed.
User InteractionRequiredRequires user action (click, file open, etc).
ScopeChangedImpact extends beyond the vulnerable component (e.g. sandbox escape).
Confidentiality ImpactHighTotal disclosure of sensitive data.
Integrity ImpactHighTotal compromise of integrity — full data modification possible.
Availability ImpactHighTotal loss of availability — full DoS possible.

EPSS

Exploit prediction · 30-day horizonFIRST.org →

1.05%

probability of exploitation in next 30 days

p64

higher than 64% of all CVEs

3-day trend↑ 0pp

Mid-pack — moderate exploitation likelihood.

Vendor VEX

No VEX statements published for CVE-2023-47534. Vendors publish VEX (Vulnerability Exploitability eXchange) to assert per-product whether a CVE is actually exploitable in their distribution.

SSVCTrack

Total impact on non-trivial mission systems

exploitation: none
automatable: yes
impact: total
mission: support

Lifecycle

2024-03-12Published
2026-10-22Last modified1 source

References

https://fortiguard.com/psirt/FG-IR-23-390