← CVE Radar
CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
9.8 CRITICALEPSS 85.68%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.2 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RC:R |
CISA required action
⚡ Known exploited · remediation due Jul 4, 2023
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2023-27997
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Jun 13, 2023
- Last modified
- 2026-07-31 04:16 UTC
Affected Products
As published by the CNA in the CVE record.
FortinetFortiOS-6K7K12 version ranges
- 7.0.10
- 7.0.5
- 6.4.12
- 6.4.10
- 6.4.8
- 6.4.6
- 6.4.2
- 6.2.9 through 6.2.13
- 6.2.6 through 6.2.7
- 6.2.4
- 6.0.12 through 6.0.16
- 6.0.10
FortinetFortiProxy5 version ranges
- 7.2.0 through 7.2.3
- 7.0.0 through 7.0.9
- 2.0.0 through 2.0.12
- 1.2.0 through 1.2.13
- 1.1.0 through 1.1.6
FortinetFortiOS5 version ranges
- 7.2.0 through 7.2.4
- 7.0.0 through 7.0.11
- 6.4.0 through 6.4.12
- 6.2.0 through 6.2.13
- 6.0.0 through 6.0.16