UnknownPublished 17 Mar 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-03-17

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-03-17

Impact

The primary impact is increased exposure of Fortigate VPN devices to reconnaissance and potential exploitation attempts targeting CVE-2023-27997. Successful exploitation could lead to unauthorized access or denial of service, affecting network security and availability. However, this alert does not report any active exploitation or confirmed breaches. The reconnaissance activity may consume network resources and assist attackers in mapping defenses, but immediate impact is limited.

Defensive guidance

Organizations should verify and apply the latest Fortigate VPN patches addressing CVE-2023-27997 if available. Additionally, restrict VPN access to trusted IP ranges and implement geo-blocking where appropriate. Deploy and tune IDS/IPS to detect and block suspicious repeated GET requests to VPN login endpoints. Monitor network logs for unusual scanning patterns or suspicious user agents and investigate anomalies. Enforce multi-factor authentication on VPN access to reduce risk from potential credential bypass. Conduct regular vulnerability assessments and segment VPN infrastructure to limit lateral movement if compromised. Educate security teams to recognize reconnaissance activity and respond promptly.

Indicators of compromise

IP addresses 8

114.111.32.174ET SCAN Naver Webcrawler User-Agent (Naver.me)
125.209.235.175ET SCAN Naver Webcrawler User-Agent (Naver.me)
114.111.32.104ET SCAN Naver Webcrawler User-Agent (Naver.me)
43.130.131.18ET USER_AGENTS User-Agent (_TEST_)
43.164.197.224ET USER_AGENTS User-Agent (_TEST_)
2001:470:1:c84::20ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
43.166.224.244ET USER_AGENTS User-Agent (_TEST_)
34.74.242.206ET USER_AGENTS Suspicious User-Agent (InfoBot)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 May 2026, 02:25 UTC

Indicators of compromise

IP addresses 8

Community reviews

Related threats