CVE-2023-27997

Deeper analysis

A heap-based buffer overflow vulnerability, tracked as CWE-122 and CWE-787, affects the SSL-VPN component of FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, and 6.0.16 and below, as well as FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all versions of 1.2 and 1.1. The flaw permits remote attackers to supply specially crafted requests that trigger memory corruption, leading to arbitrary code or command execution. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible, unauthenticated attack vectors with high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can target exposed SSL-VPN interfaces to achieve full code execution on affected Fortinet appliances without user interaction. Successful exploitation grants the attacker the ability to run arbitrary commands, potentially resulting in complete device compromise, lateral movement, or persistence within the target network.

Fortinet’s PSIRT advisory FG-IR-23-097 details the affected releases and remediation steps, while CISA’s Known Exploited Vulnerabilities catalog confirms active exploitation in the wild. The associated EPSS score has remained consistently high, with a current value of 0.9141 and a recorded peak of 0.9242, underscoring sustained attacker interest following disclosure.