Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now

Update 6/12/23 added below: Fortinet released a new advisory warning that the vulnerability may have been exploited in attacks.

Fortinet has released new Fortigate firmware updates that fix an undisclosed, critical pre-authentication remote code execution vulnerability in SSL VPN devices, tracked as CVE-2023-27997.

The security fixes were released on Friday in FortiOS firmware versions 6.0.17, 6.2.15, 6.4.13, 7.0.12, and 7.2.5.

While not mentioned in the release notes, security professionals and admins have hinted that the updates quietly fixed a critical SSL-VPN RCE vulnerability that would be disclosed on Tuesday, June 13th, 2023.

"The flaw would allow a hostile agent to interfere via the VPN, even if the MFA is activated," reads an advisory from French cybersecurity firm Olympe Cyberdefense.

"To date, all versions would be affected, we are waiting for the release of the CVE on June 13, 2023 to confirm this information."

Fortinet is known to push out security patches prior to disclosing critical vulnerabilities to give customers time to update their devices before threat actors reverse engineer the patches.

Today, additional information was disclosed by Lexfo Security vulnerability researcher Charles Fol, who told BleepingComputer that the new FortiOS updates include a fix for a critical RCE vulnerability discovered by him and Rioru.

"Fortinet published a patch for CVE-2023-27997, the Remote Code Execution vulnerability @DDXhunter and I reported," reads a tweet by Fol.

"This is reachable pre-authentication, on every SSL VPN appliance. Patch your Fortigate. Details at a later time. #xortigate."

Fol confirmed to BleepingComputer that this should be considered an urgent patch for Fortinet admins as its likely to be quickly analyzed and discovered by threat actors.

Fortinet devices are some of the most popular firewall and VPN devices in the market, making them a popular target for attacks.

Per a Shodan search, over 250,000 Fortigate firewalls can be reached from the Internet, and as this bug affects all previous versions, the majority are likely exposed.

In the past, SSL-VPN flaws have been exploited by threat actors just days after patches are released, commonly used to gain initial access to networks to conduct data theft and ransomware attacks.

Therefore, admins must apply Fortinet security updates as soon as they become available.

BleepingComputer has contacted Fortinet to learn more about the updates, but a reply was not immediately available.

Update 6/11/23 8:35 PM ET: Fortinet shared the following statement with BleepingComputer after contacting them about whether the bug was exploited.

"Timely and ongoing communications with our customers is a key component in our efforts to best protect and secure their organization. There are instances where confidential advance customer communications can include early warning on Advisories to enable customers to further strengthen their security posture, prior to the Advisory being publicly released to a broader audience. This process follows best practices for responsible disclosure to ensure our customers have the timely information they need to help them make informed risk-based decisions. For more on Fortinet’s responsible disclosure process, visit the Fortinet Product Security Incident Response Team (PSIRT) page: https://www.fortiguard.com/psirt_policy."

Update 6/11/23 06:01 PM ET: Fortinet has said that the new vulnerability, CVE-2023-27997, may have been exploited in attacks against government, manufacturing, and critical infrastructure.

"Our investigation found that one issue (FG-IR-23-097) may have been exploited in a limited number of cases and we are working closely with customers to monitor the situation," reads the new advisory.

Fortinet also shard the following statement with BleepingComputer.

"We published a PSIRT advisory (FG-IR-23-097) on June 12th that details recommended next steps regarding CVE-2023-27997. Fortinet continues to monitor the situation and has been proactively communicating to customers, strongly urging them to immediately follow the guidance provided to mitigate the vulnerability using either the provided workarounds or by upgrading. As follow-up to this, we have shared additional detail and clarifications to help our customers make informed, risk-based decisions regarding CVE-2022-27997 in this blog. For more information, please refer to the blog and advisory."

Understanding the Recent Fluctuations of Fortinet Inc.’s (FTNT) Stock

In the past week, FTNT stock has gone down by -3.14%, with a monthly gain of 2.27% and a quarterly surge of 16.47%. The volatility ratio for the week is 4.27%, and the volatility levels for the last 30 days are 2.93% for Fortinet Inc. The simple moving average for the last 20 days is 0.88% for FTNT stock, with a simple moving average of 21.49% for the last 200 days.

Fortinet Inc. (NASDAQ: FTNT) has a price-to-earnings ratio that is above its average at 56.07x. and a 36-month beta value of 1.14. Opinions on the stock are mixed, with 20 analysts rating it as a “buy,” 4 as “overweight,” 11 as “hold,” and 0 as “sell.”

The average price predicted for Fortinet Inc. (FTNT) by analysts is $75.48, which is $5.36 above the current market price. The public float for FTNT is 633.43M, and at present, short sellers hold a 2.01% of that float. On June 12, 2023, the average trading volume of FTNT was 4.67M shares.

Fortinet Inc. (NASDAQ: FTNT)’s stock price has plunge by 1.50relation to previous closing price of 68.01. Nevertheless, the company has seen a -3.14% plunge in its stock price over the last five trading sessions.

Many brokerage firms have already submitted their reports for FTNT stocks, with BofA Securities repeating the rating for FTNT by listing it as a “Buy.” The predicted price for FTNT in the upcoming period, according to BofA Securities is $75 based on the research report published on May 08th of the current year 2023.

After a stumble in the market that brought FTNT to its low price for the period of the last 52 weeks, the company was unable to rebound, for now settling with -3.63% of loss for the given period.

Volatility was left at 2.93%, however, over the last 30 days, the volatility rate increased by 4.27%, as shares surge +1.81% for the moving average over the last 20 days. Over the last 50 days, in opposition, the stock is trading +4.85% upper at present.

During the last 5 trading sessions, FTNT fell by -3.19%, which changed the moving average for the period of 200-days by +37.56% in comparison to the 20-day moving average, which settled at $68.49. In addition, Fortinet Inc. saw 41.19% in overturn over a single year, with a tendency to cut further gains.

Reports are indicating that there were more than several insider trading activities at FTNT starting from Jensen Keith, who sale 24,710 shares at the price of $68.18 back on May 23. After this action, Jensen Keith now owns 4,572 shares of Fortinet Inc., valued at $1,684,842 using the latest closing price.

Perche Patrice, the Chief Revenue Off./EVP Supp. of Fortinet Inc., sale 7,535 shares at $70.24 during a trade that took place back on May 22, which means that Perche Patrice is holding 25,730 shares at $529,290 based on the most recent closing price.

Current profitability levels for the company are sitting at:

The net margin for Fortinet Inc. stands at +19.41. The total capital return value is set at 72.61, while invested capital returns managed to touch 66.41. Equity return is now at value -297.90, with 16.30 for asset returns.

When we switch over and look at the enterprise to sales, we see a ratio of 11.23, with the company’s debt to enterprise value settled at 0.03. The receivables turnover for the company is 4.27 and the total asset turnover is 0.73. The liquidity ratio also appears to be rather interesting for investors as it stands at 1.24.

To sum up, Fortinet Inc. (FTNT) has seen a better performance recently. Analysts have differing views on the stock, with some seeing it as a “buy” and others as a “hold”. It is worth mentioning that the stock is currently trading in close proximity to its 50-day moving average and its 52-week high.

Windstream Enterprise and Fortinet Launch LAN Services that Deliver Seamless Network Integration