Cve-2023-27997 — CraftedSignal Threat Feed

KRVTZ-NET IDS Alerts Analysis: Network Scanning and Exploitation Attempts

hello@craftedsignal.io — Fri, 13 Mar 2026 20:52:20 +0000

On March 13, 2026, KRVTZ-NET IDS systems generated a series of alerts indicative of network scanning and attempted exploitation. The alerts highlight suspicious activity originating from a range of IP addresses, suggesting a widespread campaign rather than a targeted attack from a single actor. Specific alerts include repeated GET requests to /remote/logincheck, potentially targeting the Fortigate VPN vulnerability CVE-2023-27997, as well as requests for hidden environment files and attempts…

Fortigate VPN CVE-2023-27997 Exploitation Attempt

hello@craftedsignal.io — Sat, 28 Feb 2026 00:46:45 +0000

On February 28, 2026, network intrusion detection systems (IDS) flagged suspicious activity indicative of a potential exploit targeting Fortigate VPN servers. The activity involves a series of repeated GET requests directed towards the /remote/logincheck endpoint, a known attack vector associated with CVE-2023-27997. This vulnerability allows unauthenticated attackers to execute arbitrary code via specially crafted requests. The observed traffic originates from the IPv6 address…

Fortigate VPN Exploit Attempt via CVE-2023-27997 and Suspicious User-Agent

hello@craftedsignal.io — Thu, 26 Feb 2026 07:27:12 +0000

On February 26, 2026, network intrusion detection systems (IDS) triggered alerts related to potential exploitation attempts targeting Fortigate VPN servers. The alerts highlight suspicious network activity originating from multiple IP addresses, specifically repeated GET requests to the /remote/logincheck endpoint, a known vulnerability associated with CVE-2023-27997. This vulnerability could allow unauthorized access to the VPN. Additionally, an IPv4 address was observed using a suspicious…