KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2023-27997
Fortinet · FortiOS SSL-VPN
Heap-based buffer overflow in FortiOS SSL-VPN web portal allowing unauthenticated remote code execution abused in state-sponsored pre-positioning.
Correlated Federal Court Cases & Exploitation Context (1)
Docket CISA-AA24-038A · Federal Law Enforcement Action / FISA Court Authorized Operations
Volt Typhoon Critical Infrastructure Pre-Positioning State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Exploitation Ground Zero: Exploitation of zero-day vulnerabilities in edge networking appliances (Fortinet, Ivanti, Cisco, NETGEAR routers) combined with the KV-botnet of compromised small-office/home-office (SOHO) routers used as obfuscation proxies.
Operational Impact: Pre-positioned inside critical infrastructure facilities across the United States and Guam, including drinking water treatment plants, telecommunications switching hubs, electric utility grids, and maritime port facilities. The objective was not financial extortion or immediate espionage, but dormant pre-positioning for disruptive sabotage during a potential geopolitical crisis.
Sector: Communications, Energy, Transportation, Water, Defense Industrial Base · Loss: $150.0 million
Inspect Full Case Dossier →
Associated Government Advisories
- AA24-038A CISA Alert →