CVE-2023-27997

This is a serious bug in some FortiOS/FortiProxy setups that can be triggered over the network when someone sends specially crafted “requests” to the SSL-VPN feature. Instead of just causing a service error, it can let an attacker run code on the device—like getting a master key to the front door of your network gateway.

This matters if you run FortiOS or FortiProxy and have SSL-VPN enabled on those devices. It is a network-based flaw with no login required, so it’s most relevant when an attacker can reach the SSL-VPN service from the internet or other untrusted networks. Based on the findings, the main reachability gate is whether SSL-VPN is exposed/reachable (the findings do not confirm whether it’s reachable in the default configuration).

This is urgent because CISA’s KEV lists CVE-2023-27997 as being used in ransomware campaigns, meaning attackers are actively targeting it. Given it is an unauthenticated remote code execution issue in SSL-VPN, you should treat any exposed affected device as a current risk and prioritize upgrading immediately.

1. Confirm exposure and affected software

   • Identify the exact product and version:
     • FortiOS is affected if it is 7.2.4 or below, 7.0.11 or below, 6.4.12 or below, or 6.0.16 or below.
     • FortiProxy is affected if it is 7.2.3 or below.
   • Verify whether SSL-VPN is enabled and what networks can reach it.
     • The findings do not confirm “reachable in default config,” so your job is to check whether SSL-VPN is publicly reachable or reachable from untrusted networks.

2. Apply the vendor fix

   • Use the vendor remediation described in PSIRT FG-IR-23-097 (linked in the findings).
   • Upgrade FortiOS 6K7K to one of the fixed versions:
     • 7.0.12 or above, or
     • 6.4.13 or above, or
     • 6.2.15 or above, or
     • 6.0.17 or above.
   • For FortiProxy, follow the same PSIRT guidance to reach the fixed FortiProxy version (the findings specifically list affected FortiProxy 7.2.3 and below, but do not provide the exact fixed FortiProxy version number in the excerpt).

3. If patching is delayed (temporary mitigation)

   • Immediately reduce the attack surface:
     • Disable SSL-VPN exposure to the internet, and
     • Restrict access to SSL-VPN to only trusted networks/users.
   • This won’t fix the underlying bug, but it can stop remote attackers from reaching the vulnerable service.

4. Timing / urgency

   • CISA KEV lists a remediation due date of 2023-07-04 for this vulnerability. Treat that as already elapsed; prioritize the upgrade now.

5. After the upgrade

   • Re-check the device version to ensure it is on a fixed release.
   • Confirm SSL-VPN accessibility rules still match your intended access controls.
   • Monitor for any unusual SSL-VPN activity around the time of exposure and upgrade.

Severity: critical (CVSS 9.8). Impact mechanism: heap-based buffer overflow (CWE-122; also related to memory safety issues such as CWE-787) in FortiOS SSL-VPN that can be triggered by specially crafted network requests, leading to remote code execution. Authentication and interaction: no authentication required and no user interaction required per the findings. Real-world status: CISA KEV YES; added 2023-06-13 and remediation due 2023-07-04, with “used in ransomware campaigns.” Exploit maturity: weaponization exists (EXPLOIT reports a detection template only, indicating public tooling/detection rather than only a theoretical issue). Reachability gate: the findings confirm the flaw is remote/network-triggered and tied to SSL-VPN, but do not confirm whether it is reachable in default configuration—risk is highest when the SSL-VPN service is reachable from untrusted networks. EPSS is reported as 85.7% with a flat trend, but KEV status (confirmed exploitation) is the primary driver for urgency.