Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2023-27997

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiOS-6K7K

Default version status: unaffected

  • 7.0.10affected
  • 7.0.5affected
  • 6.4.12affected
  • 6.4.10affected
  • 6.4.8affected
  • 6.4.6affected
  • 6.4.2affected
  • 6.2.9 to ≤ 6.2.13affected
  • 6.2.6 to ≤ 6.2.7affected
  • 6.2.4affected
  • 6.0.12 to ≤ 6.0.16affected
  • 6.0.10affected

Fortinet FortiProxy

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.3affected
  • 7.0.0 to ≤ 7.0.9affected
  • 2.0.0 to ≤ 2.0.12affected
  • 1.2.0 to ≤ 1.2.13affected
  • 1.1.0 to ≤ 1.1.6affected

Fortinet FortiOS

Default version status: unaffected

  • 7.2.0 to ≤ 7.2.4affected
  • 7.0.0 to ≤ 7.0.11affected
  • 6.4.0 to ≤ 6.4.12affected
  • 6.2.0 to ≤ 6.2.13affected
  • 6.0.0 to ≤ 6.0.16affected

References