CVE-2023-27997

CVE-2023-27997 is a critical vulnerability (with a CVSS score of 9.2) in FortiOS and FortiProxy, which could lead to remote code execution (RCE). This flaw, discovered in the software design or implementation, was reportedly exploited by Volt Typhoon, a state-sponsored actor based in China, as part of their LODEINFO Campaign #2 in 2023. The exploit was also found being used against other enterprise products such as Array AG (CVE-2023-28461) and Proself (CVE-2023-45727), highlighting a trend of these vulnerabilities being abused in the wild. Earlier in the month, Fortinet acknowledged that CVE-2023-27997 may have been abused in limited attacks targeting government, manufacturing, and critical infrastructure sectors. A subsequent scan of public internet-exposed Fortinet FortiOS and FortiProxy SSL-VPNs interfaces by Bishop Fox security researchers revealed that 69% of the total 490,000 interfaces scanned were vulnerable to this RCE vulnerability. Over 300,000 Fortinet firewalls were found to be at risk due to this vulnerability, adding to the concerns for Fortinet users. Despite Fortinet releasing security updates to patch the issue, more than 300,000 of FortiGate firewalls still remain unpatched against this critical remote execution flaw almost a month after the update. Among the 489,337 devices discovered by the query, there were varying degrees of vulnerability to CVE-2023-27997, known as Xortigate. Check Point IPS provides protection against this threat, however, the continued active exploitation of this vulnerability necessitates urgent attention and remediation from all Fortinet users.