Fortinet Addresses Critical FortiGate SSL-VPN Vulnerability

Network security option supplier Fortinet has patched a critical bug in its FortiOS and FortiProxy SSL-VPN software package that could be exploited to hijack products.

The vulnerability, recognized as CVE-2023-27997 with a CVSS score of 9.2, reportedly authorized remote code execution and was initially learned by a security analyst at Lexfo.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The security fixes have been provided in the FortiOS firmware versions 6..17, 6.2.15, 6.4.13, 7..12 and 7.2.5.

Read through more on Fortinet vulnerabilities: Organizations Urged to Address Critical Vulnerabilities Located in Initial 50 % of 2023

Interestingly, the launch notes did not initially mention the critical SSL-VPN RCE vulnerability staying tackled. Nevertheless, security industry experts and administrators, such as Charles Fol from Lexfo, have hinted that these updates silently dealt with the flaw, which was scheduled to be disclosed on June 13 2023.

Composing on Twitter on Monday, Fol disclosed that the most current FortiOS updates include a take care of for a critical RCE vulnerability he and Rioru had found.

“Fortinet has experienced to respond to a selection of current vulnerabilities, and this is a further superior illustration,” commented Mike Parkin, senior specialized engineer at Vulcan Cyber.

In accordance to the security expert, it is not unusual for a patch to be unveiled to deal with a vulnerability in advance of publicly acknowledging its existence. 

Presently, it stays uncertain regardless of whether the vulnerability has been exploited in genuine-globe attacks or if understanding of it extends outside of the initial investigate conclusions.

“While scientists were being equipped to develop a evidence of thought, that does not often translate into a weaponized exploit,” Parkin included.

“That reported, once the PoC [Proof of Concept] is made community […] menace actors will consider and generate their have attack to leverage the exploit, which signifies Fortinet’s people require to patch their methods as quickly as the patches are offered.”

A different PoC was produced by Vulcan Cyber very last week concerning a new strategy to use ChatGPT as an attack vector.

Editorial impression credit: T. Schneider / Shutterstock.com