CVE DatabaseCVE-2023-27997

Updated 2026-07-31한국어 권고문 →

CVE-2023-279979.8/CRITICALCISA KEVCWE-122CWE-787

Fortinet FortiOS and FortiProxy SSL-VPN Heap-based Buffer Overflow Vulnerability (CVE-2023-27997) Technical Advisory

⚡ Jump to Patch

Affected Vendors

fortinet

Affected Components

fortios, fortiproxy

Published Date

2023-06-13

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

85.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

Impact

An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

Mitigation

Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

Affected Products & Version Scope

FortiOS 7.2.0 to 7.2.4, 7.0.0 to 7.0.11, 6.4.0 to 6.4.12, 6.0.0 to 6.0.16; FortiProxy 7.2.0 to 7.2.3, 7.0.0 to 7.0.9, 2.0.0 to 2.0.12, and all 1.2.x and 1.1.x versions

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

To permanently remediate the vulnerability, upgrade the appliance firmware to the recommended patched versions (e.g., FortiOS 7.2.5+, 7.0.12+, 6.4.13+, 6.0.17+). Execute the following commands via the CLI:

bash

# Verify current firmware version
get system status

# Perform firmware upgrade via TFTP server
execute restore image tftp FortiOS_7.2.5.out 192.168.1.100

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, disable the SSL-VPN service entirely or restrict access to trusted administrative IP addresses using Local-In policies.

bash

# Disable SSL-VPN service
config vpn ssl settings
    set status disable
end

# Restrict SSL-VPN access to trusted source IPs using Local-In Policy
config firewall address
    edit 'Trusted_Admin_IP'
        set subnet 203.0.113.50 255.255.255.255
    next
end
config firewall local-in-policy
    edit 1
        set intf 'any'
        set srcaddr 'Trusted_Admin_IP'
        set dstaddr 'all'
        set action accept
        set service 'SSL-VPN-Port'
    next
    edit 2
        set intf 'any'
        set srcaddr 'all'
        set dstaddr 'all'
        set action deny
        set service 'SSL-VPN-Port'
    next
end

3. Log Audit & IoC Verification Commands

Inspect the system crash logs and VPN event logs to identify potential exploitation attempts or anomalous daemon behavior.

bash

# Check for sslvpnd process crashes in the system crash log
diag debug crashlog read | grep -i 'sslvpnd'

# Filter and display VPN event logs for anomalous connection errors
execute log filter category event
execute log filter field subtype vpn
execute log display | grep -E 'error|failed|invalid'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately patch all internet-facing FortiOS SSL-VPN interfaces to prevent network intrusion.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-27997) is a critical heap-based buffer overflow (CWE-122) residing in the SSL-VPN daemon (sslvpnd) of Fortinet FortiOS and FortiProxy. The root cause is a lack of proper boundary validation (CWE-787) when copying user-supplied HTTP request parameters into a pre-allocated heap buffer during the SSL-VPN pre-authentication phase.

2. Exploitation Mechanics & Attack Scenario

An attacker targets the exposed SSL-VPN port (typically TCP 10443 or 443) and sends a series of maliciously crafted HTTP POST requests. By manipulating the length headers and payload size, the attacker overflows the allocated heap chunk, overwriting adjacent control structures in memory. This allows the attacker to hijack the control flow of the sslvpnd process, bypass authentication, and achieve remote code execution (RCE) with administrative privileges.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 and active exploitation confirmed in the wild (CISA KEV), this vulnerability poses an extreme risk. Because VPN gateways serve as the primary entry point to corporate networks, successful exploitation allows threat actors to establish persistent backdoors, pivot laterally across internal segments, harvest credentials, and deploy ransomware.

Official Vendor Advisories & References

NVD Original English Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

https://fortiguard.com/psirt/FG-IR-23-097

Source: psirt@fortinet.com · Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-097

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2023-27997)

FAQ

Q1. How critical is CVE-2023-27997 and is it actively exploited in the wild?

CVE-2023-27997 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 85.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2023-27997?

Primary impacted vendors include fortinet across fortios, fortiproxy. Scope summary: FortiOS 7.2.0 to 7.2.4, 7.0.0 to 7.0.11, 6.4.0 to 6.4.12, 6.0.0 to 6.0.16; FortiProxy 7.2.0 to 7.2.3, 7.0.0 to 7.0.9, 2.0.0 to 2.0.12, and all 1.2.x and 1.1.x versions

Q3. What temporary mitigations or workarounds exist for CVE-2023-27997 before patching?

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION