CVE-2023-27997: Heap buffer overflow in sslvpn pre-authentication

Published Jun 12, 2023

Updated

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiProxy SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Workaround:

Disable SSL-VPN.

Other sources

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

— CISA

Affected Software

44 affected components

Fortinet FortiOS and FortiProxy SSL-VPN

Fortinet FortiProxy>=1.1.0<=1.1.6

Fortinet FortiProxy>=1.2.0<=1.2.13

Fortinet FortiProxy>=2.0.0<=2.0.12

Fortinet FortiProxy>=7.0.0<=7.0.9

Fortinet FortiProxy>=7.2.0<=7.2.3

Fortinet FortiOS>=6.0.0<=6.0.16

Fortinet FortiOS>=6.2.0<=6.2.13

Fortinet FortiOS>=6.4.0<=6.4.12

Fortinet FortiOS>=7.0.0<=7.0.11

Fortinet FortiOS>=7.2.0<=7.2.4

All of the following

Any of the following

Fortinet FortiOS>=6.0.12<=6.0.16

Fortinet FortiOS>=6.2.9<=6.2.13

Fortinet FortiOS=6.0.10

Fortinet FortiOS=6.2.4

Fortinet FortiOS=6.2.6

Fortinet FortiOS=6.2.7

Fortinet FortiOS=6.4.2

Fortinet FortiOS=6.4.6

Fortinet FortiOS=6.4.8

Fortinet FortiOS=6.4.10

Fortinet FortiOS=6.4.12

Fortinet FortiOS=7.0.5

Fortinet FortiOS=7.0.10

Any of the following

Fortinet Fortigate 6000

Fortinet Fortigate 7000

Fortinet FortiOS-6K7K>=6.2.10<=6.2.13

Fortinet FortiOS-6K7K=6.0.10

Fortinet FortiOS-6K7K=6.0.12

Fortinet FortiOS-6K7K=6.0.13

Fortinet FortiOS-6K7K=6.0.14

Fortinet FortiOS-6K7K=6.0.15

Fortinet FortiOS-6K7K=6.0.16

Fortinet FortiOS-6K7K=6.2.4

Fortinet FortiOS-6K7K=6.2.6

Fortinet FortiOS-6K7K=6.2.7

Fortinet FortiOS-6K7K=6.2.9

Fortinet FortiOS-6K7K=6.4.2

Fortinet FortiOS-6K7K=6.4.6

Fortinet FortiOS-6K7K=6.4.8

Fortinet FortiOS-6K7K=6.4.10

Fortinet FortiOS-6K7K=6.4.12

Fortinet FortiOS-6K7K=7.0.5

Fortinet FortiOS-6K7K=7.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 6.0.17
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 6.2.14
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 6.4.13
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.0.12
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.2.5
Upgrade
Upgrade FortiOS to a version that resolves this vulnerability.
Fixed in 7.4.0
Upgrade
Upgrade FortiOS-6K7K to a version that resolves this vulnerability.
Fixed in 6.0.17
Upgrade
Upgrade FortiOS-6K7K to a version that resolves this vulnerability.
Fixed in 6.2.15
Upgrade
Upgrade FortiOS-6K7K to a version that resolves this vulnerability.
Fixed in 6.4.13
Upgrade
Upgrade FortiOS-6K7K to a version that resolves this vulnerability.
Fixed in 7.0.12
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.0.10
Upgrade
Upgrade FortiProxy to a version that resolves this vulnerability.
Fixed in 7.2.4
Configuration
Disable SSL-VPN on affected FortiOS devices.
FortiOS SSL-VPN SSL-VPN = disabled
Configuration
Disable SSL-VPN webmode on affected FortiProxy devices.
FortiProxy SSL-VPN (webmode) SSL-VPN = disabled

Event History

Jun 12, 2023

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Jun 13, 2023

CVE Published

via CISA·12:00 AM

Known Exploited

via CISA·12:00 AM

Known Ransomware

via CISA·12:00 AM

CVE Published

via MITRE·08:41 AM

Data Sourced

via MITRE·08:41 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeaknessAffected Software

Feb 9, 2024

News Published

via BleepingComputer·09:02 PM

Feb 13, 2024

News Published

via BleepingComputer·09:04 PM

Mar 13, 2024

News Published

via BleepingComputer·06:48 PM

Mar 18, 2024

News Published

via The Register·07:00 PM

News Published

via The Register·07:03 PM

May 28, 2024

News Published

via BleepingComputer·04:16 PM

Oct 16, 2024

News Published

via BleepingComputer·10:12 PM

Oct 23, 2024

News Published

via BleepingComputer·03:05 PM

Dec 31, 2024

News Published

via The Register·12:15 PM

Jan 9, 2025

News Published

via BleepingComputer·05:20 PM

Jan 10, 2025

News Published

via Dark Reading·02:00 AM

News Published

via Dark Reading·02:01 AM

Apr 11, 2025

News Published

via BleepingComputer·04:08 PM

Jun 6, 2025

News Published

via BleepingComputer·01:53 PM

Nov 18, 2025

News Published

via BleepingComputer·07:01 PM

Dec 9, 2025

News Published

via BleepingComputer·06:36 PM

Dec 19, 2025

News Published

via BleepingComputer·03:00 PM

Jan 2, 2026

News Published

via BleepingComputer·04:01 PM

Jan 16, 2026

News Published

via BleepingComputer·10:29 AM

Jun 18, 2026

News Published

via Dark Reading·07:09 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2023-27997: Heap buffer overflow in sslvpn pre-authentication

Other sources

Affected Software

Remediation

Event History

Peer vulnerabilities

Don't miss critical vulnerabilities

Company

Resources

Contact