Security News > 2023 > June > Fortinet patches pre-auth RCE, update your Fortigate firewalls ASAP! (CVE-2023-27997)
Fortinet has released several versions of FortiOS, the OS/firmware powering its Fortigate firewalls and other devices, without mentioning that they include a fix for CVE-2023-27997, a remote code execution flaw that does not require the attacker to be logged in to exploit it.
The vulnerability has been fixed in FortiOS versions 7.2.5, 7.0.12, 6.4.13, 6.2.15 and, apparently also in v6.0.17.
Enterprise admins are advised to upgrade Fortigate devices as soon as possible - if the vulnerability is not already being exploited by attackers, it's likely that it will soon be.
The exact nature of the vulnerability is currently unknown.
Vulnerabilities affecting Fortigate firewalls have been a popular target in the past.
Fortinet has been known to push out critical fixes without mentioning vulnerabilities - whether actively exploited or not.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-06-13 | CVE-2023-27997 | Out-of-bounds Write vulnerability in Fortinet Fortios and Fortiproxy A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests. | 9.8 |