Skip to content
VulniPulse
Sign in
Critical9.2Fortinet Exploited CISA KEV

Critical [CVE-2023-27997] FortiOS-6K7K: heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version…

This critical-severity Fortinet advisory covers CVE-2023-27997 affecting FortiOS-6K7K, FortiProxy.

CVE-2023-27997 Published Jun 13, 2023Updated by vendor Jun 12, 2023
CVE-2023-27997
Affected products & platforms
FortinetFortiGateFirewallFortiOSFortiProxy
Open vendor advisory

Android app · Google Play

Monitor future Fortinet CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Affected products named by the advisory: FortiOS-6K7K.

CISA Known Exploited Vulnerability

Listed:
Jun 13, 2023 · federal remediation due Jul 4, 2023
Required action:
Apply updates per vendor instructions.
Ransomware use:
Known

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • FortiOS: 6.0.0 through 7.2.4 (vendor-listed versions)
  • FortiOS-6K7K: 6.0.10 through 7.0.10 (vendor-listed versions)
  • FortiProxy: 1.1.0 through 7.2.3 (vendor-listed versions)

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Fixed versions
  • FortiOS 7.2: 7.2.5
  • FortiOS 7.0: 7.0.12
  • FortiOS 6.4: 6.4.13
  • FortiOS 6.2: 6.2.14
  • FortiOS 6.0: 6.0.17
  • FortiOS-6K7K 7.0: 7.0.12
  • FortiOS-6K7K 6.4: 6.4.13
  • FortiOS-6K7K 6.2: 6.2.15
  • FortiOS-6K7K 6.0: 6.0.17
  • FortiProxy 7.2: 7.2.4
  • FortiProxy 7.0: 7.0.10
  • FortiProxy 2.0: 2.0.13
  • FortiProxy 1.2: migrate to a fixed release
  • FortiProxy 1.1: migrate to a fixed release

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade per the Affected/Solution table: FortiOS 7.2: 7.2.5; FortiOS 7.0: 7.0.12; FortiOS 6.4: 6.4.13; FortiOS 6.2: 6.2.14; FortiOS 6.0: 6.0.17; ….
Temporary workarounds
  • Disable SSL-VPN.

Official advisory · high-confidence parse· fetched 9 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.