CVE-2022-42475

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

From the Tenable Blog

AA23-250A: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

Published: 2023-09-07

A joint Cybersecurity Advisory examines the exploitation of two critical vulnerabilities by nation-state threat actors.

CVE-2022-42475: Fortinet Patches Zero Day in FortiOS SSL VPNs

Published: 2022-12-12

Fortinet has patched a zero day buffer overflow in FortiOS that could lead to remote code execution. There has been a report of active exploitation and organizations should patch urgently.

References

https://www.securityweek.com/threat-actor-allegedly-selling-fortinet-firewall-zero-day-exploit/

https://www.darkreading.com/vulnerabilities-threats/fortinet-zero-day-arbitrary-code-execution

https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities

https://www.bleepingcomputer.com/news/security/fortinet-hackers-retain-access-to-patched-fortigate-vpns-using-symlinks/

https://thehackernews.com/2025/04/fortinet-warns-attackers-retain.html

https://www.tenable.com/blog/cve-2024-55591-fortinet-authentication-bypass-zero-day-vulnerability-exploited-in-the-wild

https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-critical-fortimanager-flaw-used-in-zero-day-attacks/

https://www.bleepingcomputer.com/news/security/cisa-says-critical-fortinet-rce-flaw-now-exploited-in-attacks/

https://www.welivesecurity.com/en/eset-research/cosmicbeetle-steps-up-probation-period-ransomhub

https://thehackernews.com/2024/09/cosmicbeetle-deploys-custom-scransom.html

https://thehackernews.com/2024/06/chinese-cyber-espionage-group-exploits.html

https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations

https://www.bleepingcomputer.com/news/security/chinese-hackers-breached-20-000-fortigate-systems-worldwide/

https://www.tenable.com/blog/cve-2024-21762-critical-fortinet-fortios-out-of-bound-write-ssl-vpn-vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

https://www.bleepingcomputer.com/news/security/chinese-hackers-infect-dutch-military-network-with-malware/

https://www.tenable.com/blog/aa23-250a-multiple-nation-state-threat-actors-exploit-cve-2022-47966-and-cve-2022-42475

https://www.tenable.com/blog/aa23-215a-2022s-top-routinely-exploited-vulnerabilities

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a

https://www.tenable.com/blog/cve-2023-27997-heap-based-buffer-overflow-in-fortinet-fortios-and-fortiproxy-ssl-vpn-xortigate

https://www.tenable.com/blog/volt-typhoon-cybersecurity-advisory

https://thehackernews.com/2023/03/from-ransomware-to-cyber-espionage-55.html

https://www.mandiant.com/resources/blog/zero-days-exploited-2022

https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report

https://www.tenable.com/blog/cve-2022-42475-fortinet-patches-zero-day-in-fortios-ssl-vpns

https://fortiguard.com/psirt/FG-IR-22-398

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3