ClosedPatched
FortiOS SSL-VPN pre-auth heap overflow (XORtigate, CVE-2023-27997)
Fortinet FortiOS and FortiProxy SSL-VPN
A heap overflow in the FortiOS and FortiProxy SSL-VPN allowed pre-authentication remote code execution. Fortinet said it may have been exploited in a limited number of cases, and published it alongside its analysis of the Volt Typhoon campaign.
Why this severity: CVSS 9.8 (NVD), actively exploited (CISA KEV), known ransomware use
- Started
- Jun 12, 2023
- Closed
- Jun 13, 2023
Affected
- FortiOS 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below (NVD)
- FortiProxy 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, 1.2 and 1.1 all versions (NVD)
Fixed in
- See vendor advisory FG-IR-23-097
Timeline2
CISA adds CVE-2023-27997 to the KEV catalog
Fortinet publishes FG-IR-23-097 and a blog post on exploitation and Volt Typhoon
Source
Advisories4
Get an email when a new major security incident drops. No spam, unsubscribe any time.
