Search: CVE-2023-27997

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

The KRVTZ-NET IDS alerts for 2026-05-17 report multiple network reconnaissance and scanning activities, including repeated exploit attempts against Fortigate VPN (CVE-2023-27997) and a React Server Components vulnerability (CVE-2025-55182). Several IP addresses were observed making suspicious requests such as repeated GET requests to /remote/logincheck and attempts to access hidden environment files. These activities are indicative of preliminary probing rather than confirmed exploitation. No known exploits in the wild or confirmed breaches have been reported. The overall severity is assessed as low due to the absence of confirmed successful attacks.

The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.

The KRVTZ-NET IDS alerts for 2026-05-05 report low-severity network reconnaissance activity involving multiple IP addresses linked to scanning and exploitation attempts. The alert includes indicators related to known vulnerabilities such as CVE-2025-55182 affecting React Server Components and CVE-2023-27997 targeting Fortigate VPN. No affected product versions or active exploitation in the wild are confirmed. Patch availability is not indicated, and no vendor advisories or specific mitigation instructions are provided. The activity primarily represents reconnaissance rather than confirmed successful exploitation.