Rapid Response Status Page Status - Axon Rapid Response - Critical RCE Vulnerability in Fortigate SSL-VPN Devices

Axon Rapid Response - Critical RCE Vulnerability in Fortigate SSL-VPN Devices

Incident Report for Rapid Response Status Page

Resolved

Dear customers,

As the team monitors the threat, we recommend that all Fortinet customers apply the security patches released by Fortinet for the affected firmware versions. For detailed information and instructions on patching, please refer to the official Fortinet advisory and blog post available at https://www.fortiguard.com/psirt/FG-IR-23-097 and https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign.

The team will notify you of any actionable new details. If you have any questions, please do not hesitate to reach out to us.

Yours,
Team Axon

Posted Jun 13, 2023 - 16:29 UTC

Investigating

Team Axon is aware of a new critical RCE flaw (CVE-2023-27997) affecting FortiGate firewalls. Fortinet devices are popular targets for attacks due to their widespread use as firewall and VPN devices.

The vulnerability, discovered by Lexfo Security researcher Charles Fol (https://twitter.com/cfreal_/status/1667852157536616451), allows unauthorized access pre-authentication on SSL VPN appliances. This means that even with multi-factor authentication enabled, a hostile agent can interfere via the VPN. Fortinet is expected to publish more details in the coming days.

To mitigate the risk, we advise enterprise admins to promptly upgrade Fortigate devices. Security patches have been released for FortiOS firmware versions 6.0.17, 6.2.15, 6.4.13, 7.0.12, and 7.2.5, which are expected to address the vulnerability.

Our team is researching the new vulnerability and will provide updates as more information regarding the vulnerability is published. We’ll privately contact customers that will be found as impacted. If you have any questions or need further assistance, please don’t hesitate to contact us.

Sincerely,
Team Axon

Posted Jun 12, 2023 - 10:01 UTC

This incident affected: Rapid Response.