ZeroDay Findings
Sign inSign up

Findings

CVE-2023-27997

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

Published Jun 13, 2023 · updated Jul 30, 2026 · fortinet fortiproxy

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 13, 2023 · Catalog

    Detected

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically c

  2. Jun 13, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 4, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jul 30, 2026 · Catalog

    Updated

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically c

Required action

Apply updates per vendor instructions.

CISA due date Jul 4, 2023

Affected

  • cpe fortinet/fortiosversion unspecified
  • cpe fortinet/fortiproxyversion unspecified
  • vendor Fortinet FortiOS and FortiProxy SSL-VPNversion unspecified

Sources

  • CISA KEVCVE-2023-27997

    Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

    cisa.gov
  • CVE.orgCVE-2023-27997

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-27997

    30-day exploitation probability 85.7%

    first.org
  • NIST NVDCVE-2023-27997

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all version

    nvd.nist.gov

References