CVE-2023-27997

CVE-2023-27997 is a critical vulnerability, designated as a heap-based buffer overflow issue, impacting Fortinet's FortiOS and FortiProxy SSL-VPN products. The flaw, with a high CVSS score of 9.2, could potentially lead to remote code execution (RCE), allowing an attacker to execute arbitrary code or commands via specifically crafted requests. This vulnerability was acknowledged by Fortinet earlier this month and has reportedly been exploited in limited attacks targeting government, manufacturing, and critical infrastructure sectors. According to research conducted by Bishop Fox security researchers, out of the total 490,000 public internet-exposed Fortinet FortiOS and FortiProxy SSL-VPNs interfaces scanned by Shodan, 69% were found vulnerable to this RCE vulnerability. More than 300,000 FortiGate firewalls remain unpatched against this critical flaw, even almost a month after Fortinet released security updates to address the issue. Over 300,000 Fortinet firewalls were identified as being at risk due to this vulnerability. In response to the threat posed by CVE-2023-27997, Check Point IPS has provided protection against this vulnerability. Fortinet has also confirmed the active exploitation of this vulnerability and has subsequently patched it. Despite these measures, a significant number of devices remain unpatched, leaving them vulnerable to potential attacks. It is crucial for all users of affected Fortinet products to apply the necessary patches and ensure their systems are secure against this serious threat.