CVE-2023-27997
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Description
CVE-2023-27997 is a critical heap-based buffer overflow vulnerability affecting the SSL-VPN component of Fortinet FortiOS and FortiProxy. This security flaw allows a remote attacker to execute arbitrary code or commands by sending specially crafted requests to the SSL-VPN interface, without requiring any authentication. The vulnerability impacts a wide range of FortiOS versions (7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below) and FortiProxy versions (7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.x versions). CISA has added CVE-2023-27997 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and the vulnerability has been associated with ransomware campaigns. With an EPSS score of 90.7%, this buffer overflow vulnerability in Fortinet products represents an extremely high risk requiring immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 1.1.0, <= 1.1.6; >= 1.2.0, <= 1.2.13; >= 2.0.0, <= 2.0.12; >= 7.0.0, <= 7.0.9; >= 7.2.0, <= 7.2.3 |
| fortinet | fortios | >= 6.0.0, <= 6.0.16; >= 6.2.0, <= 6.2.13; >= 6.4.0, <= 6.4.12; >= 7.0.0, <= 7.0.11; >= 7.2.0, <= 7.2.4; >= 6.0.12, <= 6.0.16; >= 6.2.9, <= 6.2.13; 6.0.10; 6.2.4; 6.2.6; 6.2.7; 6.4.2; 6.4.6; 6.4.8; 6.4.10; 6.4.12; 7.0.5; 7.0.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/psirt/FG-IR-23-097(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
The heap-based buffer overflow in FortiOS and FortiProxy SSL-VPN occurs when the application writes data beyond the bounds of a heap-allocated buffer during SSL-VPN request processing. This allows attackers to corrupt heap memory structures and gain control of program execution flow, enabling remote code execution on the affected Fortinet device.
Learn more: CWE-122 — Heap-based Buffer Overflow
CWE-787: Out-of-bounds Write
The out-of-bounds write weakness in FortiOS and FortiProxy manifests when the SSL-VPN component writes data past the end or before the beginning of an allocated memory buffer. In the context of CVE-2023-27997, this enables attackers to modify adjacent memory regions, potentially overwriting critical data structures to achieve arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2023-27997 carries a CVSS v3.1 score of 9.8 (Critical), reflecting its severe exploitability and impact characteristics. The vulnerability is remotely exploitable without physical access over the network, requires no authentication or user interaction, and is easy to exploit with no special conditions needed. Confidentiality (High): An attacker can access sensitive data stored on or passing through the Fortinet device, including VPN credentials, configuration data, and internal network traffic. Integrity (High): Successful exploitation enables arbitrary code execution, allowing attackers to modify system configurations, install backdoors, and alter firewall rules. Availability (High): The buffer overflow can crash the device or allow an attacker to disrupt VPN services entirely. With an EPSS score of 90.7% placing it in the 99th percentile, active exploitation is near-certain, and the confirmed association with ransomware campaigns makes this vulnerability a top priority for organizations using Fortinet SSL-VPN appliances.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-27997 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 4, 2023, and this vulnerability has been used in ransomware attacks. The EPSS score of 90.7% (99th percentile) indicates near-certain exploitation activity, making immediate patching essential. While the references do not include tagged public exploit code, the active exploitation status and ransomware association confirm that threat actors possess and are actively using working exploits against FortiOS and FortiProxy SSL-VPN deployments. Organizations should treat this as an emergency-level security event requiring immediate action.
Remediation
-
Apply vendor patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Upgrade FortiOS to version 7.2.5 or later, 7.0.12 or later, 6.4.13 or later, or 6.0.17 or later; upgrade FortiProxy to version 7.2.4 or later, 7.0.10 or later, or 2.0.13 or later. Devices running FortiProxy 1.x should be upgraded to a supported version immediately.
-
Disable SSL-VPN functionality on Fortinet devices as an interim mitigation if patching cannot be completed immediately. This removes the attack surface entirely while the update is being scheduled.
-
Restrict SSL-VPN access by implementing network-level controls such as IP allowlisting to limit which source addresses can reach the SSL-VPN interface. Place Fortinet devices behind a separate firewall or WAF that can filter malicious requests targeting the SSL-VPN endpoint.
-
Review logs and check for indicators of compromise on all FortiOS and FortiProxy devices. Examine VPN authentication logs, look for unexpected administrative changes, and check for unauthorized configuration modifications. Reset all VPN user credentials as a precaution given the ransomware association.
-
Implement memory-safe coding practices and bounds checking as a long-term hardening measure. Enable FortiOS intrusion prevention system (IPS) signatures that detect buffer overflow exploitation attempts, and ensure all Fortinet devices are enrolled in automated firmware update programs to receive future security patches promptly.
Technical Details
CVE-2023-27997 is a heap-based buffer overflow (CWE-122) combined with an out-of-bounds write (CWE-787) in the SSL-VPN component of FortiOS and FortiProxy. The vulnerability exists in the request handling logic of the SSL-VPN service, where insufficient bounds checking on user-supplied input allows an attacker to write data beyond the allocated heap buffer. As reflected in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack is network-accessible, requires low complexity, no privileges, and no user interaction, making it trivially exploitable against any internet-facing SSL-VPN endpoint. The heap corruption enables an attacker to overwrite critical memory structures, which can be leveraged to redirect program execution and achieve remote code execution with the privileges of the FortiOS process. Both CWE-122 and CWE-787 describe related memory safety issues: the heap-based buffer overflow specifically targets heap-allocated memory, while the out-of-bounds write describes the broader class of writing outside allocated buffer boundaries, and together they characterize how the crafted SSL-VPN requests corrupt memory to gain code execution.
Frequently Asked Questions
Is CVE-2023-27997 being actively exploited?
Yes, CVE-2023-27997 is being actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of July 4, 2023. The vulnerability has also been confirmed as being used in ransomware campaigns, and its EPSS score of 90.7% indicates near-certain exploitation activity.
What products are affected by CVE-2023-27997?
CVE-2023-27997 affects Fortinet FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, and 6.0.16 and below. It also affects FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all versions of FortiProxy 1.2 and 1.1. The vulnerability is specifically in the SSL-VPN component of these products.
How do I fix CVE-2023-27997?
Upgrade FortiOS to version 7.2.5+, 7.0.12+, 6.4.13+, or 6.0.17+, and FortiProxy to version 7.2.4+, 7.0.10+, or 2.0.13+. If immediate patching is not possible, disable the SSL-VPN feature entirely as an interim mitigation. Refer to the Fortinet advisory FG-IR-23-097 for detailed upgrade guidance.
How severe is CVE-2023-27997?
CVE-2023-27997 is rated Critical with a CVSS v3.1 score of 9.8 out of 10, the highest severity classification. It sits in the 99th percentile for exploitation probability (EPSS score 90.7%), and its use in ransomware attacks elevates the real-world risk significantly. Immediate remediation is strongly recommended for all affected Fortinet deployments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.