CVE-2023-27997

Published Jun 13, 2023 CVSS 3.1 · 9.2 Critical EPSS 86.8% KEV · Listed
Description
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Remediation

Vendor Solution

Please upgrade to FortiOS-6K7K version 7.0.12 or above Please upgrade to FortiOS-6K7K version 6.4.13 or above Please upgrade to FortiOS-6K7K version 6.2.15 or above Please upgrade to FortiOS-6K7K version 6.0.17 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.10 or above Please upgrade to FortiOS version 7.4.0 or above Please upgrade to FortiOS version 7.2.5 or above Please upgrade to FortiOS version 7.0.12 or above Please upgrade to FortiOS version 6.4.13 or above Please upgrade to FortiOS version 6.2.14 or above Please upgrade to FortiOS version 6.0.17 or above

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics epss

{'score': 0.90525}

epss

{'score': 0.90631}

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2023-06-13'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
fortinet
Published
Updated
Jul 31, 2026, 3:55 AM
Reserved
Mar 9, 2023, 10:09 AM
Status
Analyzed
Published
Jun 13, 2023, 9:15 AM
Modified
Jul 31, 2026, 4:16 AM