Skip to the main content.

1 min read

Pre-Authentication Critical Vulnerability in Fortinet SSL VPN

Pre-Authentication Critical Vulnerability in Fortinet SSL VPN

On Friday, June 9, 2023, Fortinet released new firmware updates for FortiOS. Over the weekend, security researchers shared on social media that this firmware update remediates a critical RCE vulnerability in the Fortinet SSL VPN devices.


Last Updated: June 12, 2023 at 3:08 PM MST

The official Fortinet Product Security Incident Response Team (PSIRT) blog stated: "Our investigation found that one issue (FG-IR-23-097) may have been exploited in a limited number of cases and we are working closely with customers to monitor the situation."

They also provided clarifications on the Volt Typhoon Campaign.


Today, security researcher Charles Fol from Lexfo Security confirmed the security update includes a fix for the RCE vulnerability and that he and another ‘Rioru’ discovered.

However, Charles stated on his Twitter feed that the vulnerability affects all Fortinet SSL VPN appliances, and the vulnerability is “reachable pre-authentication”, meaning no credentials are required to exploit the vulnerable systems.  

An additional security advisory from Olympe Cyberdefense also states that the vulnerability will work even if multi-factor authentication (MFA) is enabled.

Administrators are strongly encouraged to patch vulnerable devices immediately.

CVE-2023-27997

Critical Remote Code Execution (RCE) vulnerability in Fortinet SSL VPN appliances

Affected Products

All Fortinet SSL VPN appliances

Remediation

Upgrade to the latest FortiOS firmware versions released by Fortinet:

6.0.17

6.2.15

6.4.13

7.0.12

7.2.5


Resources

If you have questions regarding this vulnerability or would like assistance, PacketWatch can help. Contact us today.

Disclaimer
The information provided in this article is provided “as-is.” It is not finally evaluated intelligence and should be considered raw information that is provided for strictly situational awareness, given what is known at this time.

Cyber Threat Intelligence Briefing - February 26, 2024

6 min read

Cyber Threat Intelligence Briefing - February 26, 2024

This week, we continue to cover the ConnectWise ScreenConnect vulnerabilities and United Healthcare Optum Breach and include a vulnerability roundup.

Read More
Two ConnectWise ScreenConnect Critical RCE Vulnerabilities

2 min read

Two ConnectWise ScreenConnect Critical RCE Vulnerabilities

ConnectWise recently released a security bulletin disclosing two new vulnerabilities in their ScreenConnect platform.

Read More
CVE-2024-21413: Microsoft Outlook Critical RCE

2 min read

CVE-2024-21413: Microsoft Outlook Critical RCE

As part of this month's Patch Tuesday, Microsoft released a fix for a critical vulnerability affecting multiple Outlook versions.

Read More