Threat Intelligence / CVE / CVE-2023-27997

CVE-2023-27997

CISA KEVRansomware

CVSS 9.8 (CRITICAL) · EPSS 91.0% · Published 2023-06-13

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-122, CWE-787

Threats tracking this CVE

Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi — CRITICAL

References

https://fortiguard.com/psirt/FG-IR-23-097

Full detection coverage & IOCs for threats exploiting CVE-2023-27997 are available via the Threadlinqs MCP server (Purple tier). View plans →

Markdown version · Threadlinqs Intelligence