UnknownPublished 24 Mar 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-03-24

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-03-24

Impact

Successful exploitation of CVE-2023-27997 on Fortigate VPN devices could allow attackers to bypass authentication and gain unauthorized VPN access, potentially enabling lateral movement within affected networks. Access to hidden environment files and phpinfo pages can disclose sensitive configuration information, increasing the risk of further targeted attacks. Brute force attempts against haproxy services may lead to account lockouts or unauthorized access if weak credentials are present, potentially impacting service availability and integrity. Although no widespread exploitation is currently documented, organizations with exposed Fortigate VPNs and web servers remain at risk of confidentiality, integrity, and availability compromises.

Defensive guidance

Organizations should ensure all Fortigate VPN devices are updated with the latest patches addressing CVE-2023-27997. Enforce strict access controls and multi-factor authentication for VPN access to reduce unauthorized login risks. Monitor VPN and web server logs for repeated failed login attempts, unusual GET requests, and access to sensitive files indicative of reconnaissance or exploitation. Restrict or disable public access to environment configuration files and phpinfo pages on web servers. Deploy and tune IDS/IPS to detect suspicious GET requests, brute force patterns, and repeated connection attempts. Apply rate limiting and IP blacklisting for suspicious IP addresses identified in the alerts. Conduct regular vulnerability assessments and maintain updated threat intelligence feeds. Consider network segmentation to limit lateral movement and maintain robust incident response plans.

Indicators of compromise

IP addresses 6

128.14.236.30haproxy: 128.14.236.30 connecting to (submission/TCP) 15x in hour, possible bruteforcing.
2001:470:1:fb5:395a:4b73:9114:ba8ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
168.231.103.16ET INFO Request to Hidden Environment File - Inbound
2001:470:1:fb5:ef1d:7098:4cd5:e9abET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
195.178.110.108ET WEB_SERVER WEB-PHP phpinfo access
89.169.55.221ET INFO Request to Hidden Environment File - Inbound

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 May 2026, 02:23 UTC

Indicators of compromise

IP addresses 6

Community reviews

Related threats