CVE-2023-36553 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-78** (OS Command Injection). 🔍 **Flaw**: The system fails to properly sanitize inputs in API endpoints, allowing malicious payloads to be interpreted as OS commands.

Q: Who is affected? (Versions/Components)

🏢 **Affected**: Fortinet FortiSIEM. 📦 **Components**: The Security Information and Event Management system, specifically its API interfaces handling asset discovery and workflow automation.

Q: What can hackers do? (Privileges/Data)

👑 **Privileges**: High. 📂 **Data**: Full Control. Attackers gain **C:H / I:H / A:H** (High Confidentiality, Integrity, Availability impact). They can read sensitive logs, modify security policies, and crash the SIEM.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🔓 **Auth**: **Unauthenticated** (PR:N). No login required. 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit.

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Exploit**: **YES**. 📜 **PoC**: Public Proof-of-Concept available on GitHub (kenit7s/CVE-2023-36553-RCE). 🔥 **Risk**: Wild exploitation is highly likely due to ease of use.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **YES**. 📝 **Official**: Fortinet released PSIRT advisory **FG-IR-23-135**. ⬇️ **Action**: Update FortiSIEM to the patched version immediately.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: 1. **Block**: Restrict API access via Firewall/WAF. 2. **Isolate**: Segment the SIEM network. 3. **Monitor**: Alert on unusual API traffic or command execution logs.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. ⏱️ **Priority**: **IMMEDIATE**. 💡 **Reason**: Unauthenticated RCE with public PoC. Patch now to prevent total compromise.

Updated May 08, 2026 CVSS 9.3 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Unauthenticated OS Command Injection in Fortinet FortiSIEM. <br>💥 **Consequences**: Attackers can execute arbitrary commands via crafted API requests.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-78** (OS Command Injection). <br>🔍 **Flaw**: The system fails to properly sanitize inputs in API endpoints, allowing malicious payloads to be interpreted as OS commands.

Q3Who is affected? (Versions/Components)

🏢 **Affected**: Fortinet FortiSIEM. <br>📦 **Components**: The Security Information and Event Management system, specifically its API interfaces handling asset discovery and workflow automation.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: High. <br>📂 **Data**: Full Control. Attackers gain **C:H / I:H / A:H** (High Confidentiality, Integrity, Availability impact). They can read sensitive logs, modify security policies, and crash the SIEM.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: **Unauthenticated** (PR:N). No login required. <br>🌐 **Access**: Network accessible (AV:N). <br>🎯 **Complexity**: Low (AC:L). Easy to exploit.

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Exploit**: **YES**. <br>📜 **PoC**: Public Proof-of-Concept available on GitHub (kenit7s/CVE-2023-36553-RCE). <br>🔥 **Risk**: Wild exploitation is highly likely due to ease of use.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for FortiSIEM instances exposed to the internet. <br>📡 **Features**: Test API endpoints for command injection patterns.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Fix**: **YES**. <br>📝 **Official**: Fortinet released PSIRT advisory **FG-IR-23-135**. <br>⬇️ **Action**: Update FortiSIEM to the patched version immediately.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: <br>1. **Block**: Restrict API access via Firewall/WAF. <br>2. **Isolate**: Segment the SIEM network. <br>3. **Monitor**: Alert on unusual API traffic or command execution logs.

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. <br>⏱️ **Priority**: **IMMEDIATE**. <br>💡 **Reason**: Unauthenticated RCE with public PoC. Patch now to prevent total compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) Fortinet CWE-78