Explorer

Solved

CVE-2023-27997

Forum|Forum|2 years ago
June 12, 2023
9 replies
10373 views

Is there any official report on this that comes from Fortinet?

I see a lot of people patching but so far no report from Fortinet.

Thank you in advance,

Evert

FortiGate

Best answer by Late2IT

Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign | Fortinet Blog

Just subscribed to the RSS feed

freddelm

Explorer

Also Does the Vulnerability apply if SSL-VPN is not enabled on the Fortigate?

My config is

config vpn ssl settings

set status disable

JS_DC

Explorer

Also curious about this. We disabled SSL-VPN after the last public vulnerability as a mitigation and left it disabled.

Toshi_Esumi

SuperUser

It seems to come out tomorrow in I guess US time.
https://www.helpnetsecurity.com/2023/06/11/cve-2023-27997/

Toshi

EHoegeeAuthor

Explorer

Yes, that is indeed also what I got back from Support!

Late2ITAnswer

New Member

Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign | Fortinet Blog

Just subscribed to the RSS feed

EHoegeeAuthor

Explorer

You saved my day!

EHoegeeAuthor

Explorer

One more thing to note:

https://www.fortiguard.com/psirt/FG-IR-23-097

Toshi_Esumi

SuperUser

Can someone from FTNT tell us when those release notes would be updated to include "no longer vulnerable" statement in? Don't seem to be updated yet.

Toshi

Toshi_Esumi

SuperUser

I now see the release notes are updated to include the fixes.

Thanks,

Toshi

Jirka1

Explorer II

Guys,

can GEO block be used with SSL VPN as a temporary workaround?
I tried and when setting a different country than the one I'm trying to connect from the portal didn't even load.

Thanks.

Jirka

Late2IT

New Member

Doing anything other than the recommended solution is not advisable. If that action is taken as a mitigating measure, make sure you CYA.

Toshi_Esumi

SuperUser

Does FTNT have any official response to this claim yet? Maybe prohibited to say anything until the new patch version is ready though.
https://thehackernews.com/2023/06/critical-rce-flaw-discovered-in.html

Toshi

Toshi_Esumi

SuperUser

I posted the old link above. Which was addressed by the recent release. I was concerning about a different post below, but I misread the content and it was not talking about an additional vulnerability, but many of them in the world are still not upgraded to the patched version.

So it was a faulse alarm. Sorry about that.

https://thehackernews.com/2023/07/alert-330000-fortigate-firewalls-still.html

Toshi