CVE-2023-279979.2CriticalCWE-122
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet · FortiOS and FortiProxy SSL-VPN
Exploited in the wild · in CISA KEV since 13 Jun 2023Vendor fix availableKnown ransomware use
85.7%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.2CriticalCVSS 3.1
LowMediumHighCrit.
Federal deadline
CISA KEV · added 13 Jun · catalogue entry
Passed 1213 days ago
DescriptionNVD
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
CISA required action
Apply updates per vendor instructions.
Coverage1 article · 1 outlet
First in our coverage: SecurityWeek, 15 Sep.
- Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BBSecurityWeek · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.