Fortinet FortiOS CVE-2023-27997 'XORtigate' SSL-VPN heap-based buffer overflow (unauthenticated RCE, CISA KEV): which versions are fixed and can I just disable SSL-VPN?

What it is: CVE-2023-27997 (Fortinet advisory FG-IR-23-097, published June 12, 2023) is a heap-based buffer overflow in the SSL-VPN of FortiOS and FortiProxy that lets an unauthenticated remote attacker execute code or commands. Fortinet rated it critical (CVSS 9.8). CISA added it to the KEV catalog on 2023-06-13 and marks it as used in ransomware campaigns. Internet-facing SSL-VPN is the exposure, and devices that were never updated are still found in scans and attacks. Am I affected: The Fortinet advisory lists these affected releases and the fixed versions: - FortiOS 7.4: not affected - FortiOS 7.2.0 through 7.2.4: upgrade to 7.2.5 or later - FortiOS 7.0.0 through 7.0.11: upgrade to 7.0.12 or later - FortiOS 6.4.0 through 6.4.12: upgrade to 6.4.13 or later - FortiOS 6.2.0 through 6.2.13: upgrade to 6.2.14 or later - FortiOS 6.0.0 through 6.0.16: upgrade to 6.0.17 or later - FortiProxy 7.2.0-7.2.3 (fixed 7.2.4), 7.0.0-7.0.9 (fixed 7.0.10), 2.0.0-2.0.12 (fixed 2.0.13); FortiProxy 1.2 and 1.1 should migrate to a fixed release - FortiOS-6K7K has its own fixed releases (for example 7.0.12, 6.4.13, 6.2.15, 6.0.17); see the advisory table Check the version with get system status or on the dashboard, and confirm whether SSL-VPN is enabled (VPN > SSL-VPN Settings, or the sslvpn listener configuration). Fix: 1. Upgrade to a fixed release using Fortinet's upgrade path tool at docs.fortinet.com/upgrade-tool, and prefer the latest recommended release for your model. 2. Fortinet's stated workaround is to disable SSL-VPN. This is a valid interim measure when you cannot patch immediately, but plan the upgrade; users can move to IPsec VPN temporarily if that fits your design. 3. If the device was unpatched and exposed, treat it as possibly compromised: preserve logs and a configuration backup, review them for unknown administrators, changed VPN/user settings and unexpected outbound connections, check for unfamiliar files or processes through Fortinet's diagnostics, and compare with a known-good configuration. If anything is suspect, factory-reset or reimage the device, restore a verified-clean configuration, and rotate all credentials the device handles: local users, LDAP/RADIUS bind accounts, VPN pre-shared keys, certificates and private keys, and admin passwords. 4. Restrict administrative access to trusted networks and enable multi-factor authentication for VPN users. Verify: get system status shows a fixed build on each unit (check HA members too), and external scans or your own review show no unexpected SSL-VPN exposure if you chose to disable it. Sources: https://fortiguard.com/psirt/FG-IR-23-097 https://nvd.nist.gov/vuln/detail/CVE-2023-27997 https://www.cisa.gov/known-exploited-vulnerabilities-catalog