CVE-2023-27997
At a glance Severity CRITICAL 9.2 Exploitation Known exploited (CISA KEV) · added 2023-06-13 Exploited per ENISA since 2023-06-13 EPSS EPSS 85.69 % · percentile 100 (2026-10-27) State PUBLISHED Published 2023-06-13 Updated 2026-07-31 Assigner fortinet NVD status Analyzed Description A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R fortinet CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.1.0 ≤ 1.1.6cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.2.0 ≤ 1.2.13cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.12cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.9cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.3cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.13cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.11cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.4cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.12 ≤ 6.0.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.9 ≤ 6.2.13cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*Affected products Product Versions Fortinet · FortiOS-6K7K affected 7.0.10 ; affected 7.0.5 ; affected 6.4.12 ; affected 6.4.10 ; affected 6.4.8 ; affected 6.4.6 Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.3 ; affected 7.0.0 ≤ 7.0.9 ; affected 2.0.0 ≤ 2.0.12 ; affected 1.2.0 ≤ 1.2.13 ; affected 1.1.0 ≤ 1.1.6 Fortinet · FortiOS affected 7.2.0 ≤ 7.2.4 ; affected 7.0.0 ≤ 7.0.11 ; affected 6.4.0 ≤ 6.4.12 ; affected 6.2.0 ≤ 6.2.13 ; affected 6.0.0 ≤ 6.0.16
References
Sources
