CVE-2023-27997

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa💥 PoC

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 86%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 13/6/2023
Plazo de remediación: 4/7/2023
Uso conocido en ransomware: Known

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %
Impacto secundarioT1499.004 Application or System Exploitationimpact75 %

Buffer overflow en SSL-VPN expuesto (AV:N, PR:N) permite ejecución remota de código (CVE crítico, CWE-122). Confirmado en KEV con uso activo en ransomware.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Filter Network Traffic Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation

Tecnologías afectadas (2)

Fortinet — Fortios Fortinet — Fortiproxy

CWE

CWE-122
CWE-787

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2023-27997",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27997",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2023-06-12T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiOS-6K7K",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.10"
            },
            {
              "status": "affected",
              "version": "7.0.5"
            },
            {
              "status": "affected",
              "version": "6.4.12"
            },
            {
              "status": "affected",
              "version": "6.4.10"
            },
            {
              "status": "affected",
              "version": "6.4.8"
            },
            {
              "status": "affected",
              "version": "6.4.6"
            },
            {
              "status": "affected",
              "version": "6.4.2"
            },
            {
              "status": "affected",
              "version": "6.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.13"
            },
            {
              "status": "affected",
              "version": "6.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.7"
            },
            {
              "status": "affected",
              "version": "6.2.4"
            },
            {
              "status": "affected",
              "version": "6.0.12",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.16"
            },
            {
              "status": "affected",
              "version": "6.0.10"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Fortinet",
          "product": "FortiProxy",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.3"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.9"
            },
            {
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "2.0.12"
            },
            {
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.2.13"
            },
            {
              "status": "affected",
              "version": "1.1.0",
              "versionType": "semver",
              "lessThanOrEqual": "1.1.6"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Fortinet",
          "product": "FortiOS",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.4"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.11"
            },
            {
              "status": "affected",
              "version": "6.4.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.12"
            },
            {
              "status": "affected",
              "version": "6.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.13"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.16"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-06-13T09:15:16.613",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-097",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-23-097",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests."
    }
  ],
  "lastModified": "2026-07-31T04:16:43.707",
  "cisaActionDue": "2023-07-04",
  "cisaExploitAdd": "2023-06-13",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6BBF05F-4967-4A2E-A8F8-C2086097148B",
              "versionEndIncluding": "1.1.6",
              "versionStartIncluding": "1.1.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33B84D9A-55E3-4146-A55A-ACB507E61B05",
              "versionEndIncluding": "1.2.13",
              "versionStartIncluding": "1.2.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C1D5E6B-A23E-4A92-B53C-720AFEB1B951",
              "versionEndIncluding": "2.0.12",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAC18F7E-5242-4F36-BB42-FEC33B3AC075",
              "versionEndIncluding": "7.0.9",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A99FF48-370E-4D2A-B5CC-889EA21AB213",
              "versionEndIncluding": "7.2.3",
              "versionStartIncluding": "7.2.0"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EA5512D-6EE5-4DF3-A960-C02394F25225",
              "versionEndIncluding": "6.0.16",
              "versionStartIncluding": "6.0.0"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CD57A5A-2B13-495A-8530-8F97E1720602",
              "versionEndIncluding": "6.2.13",
              "versionStartIncluding": "6.2.0"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E99B6E5-7EC3-406C-AFAC-A5E32DE266DF",
              "versionEndIncluding": "6.4.12",
              "versionStartIncluding": "6.4.0"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2573C90-BE6A-4D5D-A223-F09213318909",
              "versionEndIncluding": "7.0.11",
              "versionStartIncluding": "7.0.0"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AB643A8-B52F-4D54-B816-28A6401BAA25",
              "versionEndIncluding": "7.2.4",
              "versionStartIncluding": "7.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D997493-24C2-4A78-9DF0-6438E9415A3C",
              "versionEndIncluding": "6.0.16",
              "versionStartIncluding": "6.0.12"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A0D0D55-1A51-454D-A8B1-D7100D453102",
              "versionEndIncluding": "6.2.13",
              "versionStartIncluding": "6.2.9"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6AF1FA-A034-439A-876B-BFA1BE7DE15E"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9694FC0C-408A-4892-ADD1-F36F4BBBD9EF"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B8A132F-601F-4129-BFCA-3A976A711D5A"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90600B14-07C4-455D-9FC1-17034D91B987"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B28478DA-8D10-4A8E-81EA-D3DF421E5089"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2F935F9-5B6A-47C2-8F65-7A1E8BB061FF"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "751D2FC7-482F-4C6B-95DB-244004A2738E"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEE44B20-6F00-4962-9929-5A5054BBA94C"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB2FF1DA-001B-4CA1-9F46-427D9C92CBC6"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48D0E8CC-3815-4697-86D0-DC7F66E70520"
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78C6C937-4477-438D-A252-E4102D758120"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:fortinet:fortigate_6000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3BB410C9-CDD4-4068-97E0-6D83AE62B7F1"
            },
            {
              "criteria": "cpe:2.3:h:fortinet:fortigate_7000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E0CBA773-10C1-410D-BB01-771F454ABEBA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability"
}