VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Jun 13, 2023· Updated Jul 31, 2026

CVE-2023-27997

CVE-2023-27997

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

18
  • Fortinet/Fortiproxy3 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: >=1.1.0,<=1.1.6
    • (no CPE)range: <=7.2.3, <=7.0.9, <=2.0.12, all versions, all versions
    • (no CPE)range: 7.2.0
  • Fortinet/Fortios15 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 14 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=6.0.0,<=6.0.16
    • cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*
    • (no CPE)range: <=7.2.4, <=7.0.11, <=6.4.12, <=6.0.16
    • (no CPE)range: 7.0.10
    • (no CPE)range: 7.2.0

Patches

Vulnerability mechanics

References

2

News mentions

2