Critical FortiGate SSL VPN Vulnerability Patched by Fortinet
Fortinet has fixed a critical vulnerability in its FortiGate firewall that could have been exploited by an attacker for remote code execution. The flaw, tracked as CVE-2023-27997, was discovered by French IT security company Lexfo and affects every SSL VPN appliance. An attacker could exploit the flaw without authentication and potentially interfere via the VPN. Fortinet has yet to release an advisory for the vulnerability, although it is expected to do so on 13 June. FortiOS 7.0.12, 7.2.5, 6.4.13 and 6.2.15 have reportedly been patched to address the vulnerability. Fortinet products have been targeted by both cybercrooks and cyberspies before patches have been released; The Critical Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalogue lists 10 Fortinet product vulnerabilities that have been used by malicious actors since 2018. The latest patch comes after Fortinet fixed a critical vulnerability in its data analytics solution in May.
About The Author
