Fortinet Security Update – 12 June 2023

By /
  • 131/2023
  • Critical

Fortinet has released a security update to fix a critical SSL-VPN RCE vulnerability in multiple FortiOS firmware versions.

The addressed vulnerability could allow the attacker to execute arbitrary code, and gain access by sending a specially crafted request to the affected products.

The addressed vulnerability:

Fortinet FortiGate and FortiOS Code Execution (CVE-2023-27997):

  • CVSS: 9.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

It should be highlighted that the flaw has been fixed in versions 6.2.15, 6.4.13, 7.0.12, and 7.2.5.

Vulnerabilities

CVE-2023-27997

Mitigations

The enterprise should check with the vendor for the latest patch versions released to every product individually and apply it as soon as the testing phase is completed.

References