PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2023-27997 Vulnerability Scanner for FortiGate Firewalls

bishopfox.com | vulnerability | CVE-2023-27997 | #security-tools | #detection | #fortinet | #fortigate | #vulnerability-scanner | #cve-2023-27997
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox released a non-crashing detection tool for CVE-2023-27997 that uses a timing side channel—comparing response times for valid versus invalid length fields—to check FortiGate firewalls.
CVE
CVE-2023-27997
Published
Collected

Related coverage

vulnerability · bishopfox.com
CVE-2023-27997 Is Exploitable, and 69% of FortiGate Firewalls Are Vulnerable
Bishop Fox built a working exploit for CVE-2023-27997, a FortiOS SSL VPN heap overflow allowing RCE, and found nearly 490,000 exposed interfaces via Shodan—roughly 69% unpatched.
vulnerability · bishopfox.com
Building an Exploit for FortiGate Vulnerability CVE-2023-27997
Bishop Fox walks through building a proof-of-concept exploit for CVE-2023-27997, a pre-auth heap buffer overflow in Fortinet's SSL VPN, covering the flawed length check and jemalloc heap grooming.
vulnerability · bishopfox.com
CVE-2024-21762 Vulnerability Scanner for FortiGate Firewalls
Bishop Fox built a scanner that safely detects FortiGate appliances affected by CVE-2024-21762, an out-of-bounds write in FortiOS SSL VPN, via chunked-encoding validation changes in the patch.
vulnerability · bishopfox.com
A More Complete Exploit for Fortinet CVE-2022-42475
Bishop Fox's Team X details a more complete exploit for CVE-2022-42475—the FortiGate SSL VPN heap overflow exploited in the wild—covering ROP chains, shellcode, and per-appliance targeting.
blog · bishopfox.com
Breaking Fortinet Firmware Encryption
Bishop Fox explains how it reverse engineered Fortinet's firmware image encryption—most bare-metal images ship encrypted—to enable its FortiGate version-comparison research.
vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
Back