CVE-2023-27997
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
SeverityCritical
CVSS9.8
Exploit probability100. percentile85.7%
Product
Fortinet FortiOS and FortiProxy SSL-VPN
PublishedJun 13, 2023
First seenJun 13, 2023
Added to KEVJun 13, 2023
Weakness typeCWE-122CWE-122
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jul 4, 2023Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortiproxy | 1.1.0 ≤ v ≤ 1.1.6, 1.2.0 ≤ v ≤ 1.2.13, 2.0.0 ≤ v ≤ 2.0.12, 7.0.0 ≤ v ≤ 7.0.9, 7.2.0 ≤ v ≤ 7.2.3 | — |
| fortinet fortios | 6.0.0 ≤ v ≤ 6.0.16, 6.2.0 ≤ v ≤ 6.2.13, 6.4.0 ≤ v ≤ 6.4.12, 7.0.0 ≤ v ≤ 7.0.11, 7.2.0 ≤ v ≤ 7.2.4, 6.0.12 ≤ v ≤ 6.0.16, 6.2.9 ≤ v ≤ 6.2.13, 6.0.10, 6.2.4, 6.2.6, 6.2.7, 6.4.2, 6.4.6, 6.4.8, 6.4.10, 6.4.12, 7.0.5, 7.0.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.