CVE-2022-42475

critical

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

References

https://www.theregister.com/2024/06/12/chinas_targeting_of_fortigate_systems/

https://arstechnica.com/security/2024/06/china-state-hackers-infected-20000-fortinet-vpns-dutch-spy-service-says/

https://www.bleepingcomputer.com/news/security/chinese-hackers-breached-20-000-fortigate-systems-worldwide/

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a?&web_view=true

https://www.itworldcanada.com/article/china-group-may-have-been-hiding-in-it-networks-for-five-years-says-five-eyes-warning/558369

https://securityaffairs.com/158765/apt/china-linked-apt-dutch-mod.html

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

https://www.theregister.com/2024/02/06/dutch_defense_china_cyberattack/

https://www.bleepingcomputer.com/news/security/chinese-hackers-infect-dutch-military-network-with-malware/

https://www.tenable.com/blog/aa23-250a-multiple-nation-state-threat-actors-exploit-cve-2022-47966-and-cve-2022-42475

https://www.tenable.com/blog/aa23-250a-multiple-nation-state-threat-actors-exploit-cve-2022-47966-and-cve-2022-42475

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a

https://www.tenable.com/blog/volt-typhoon-cybersecurity-advisory

https://thehackernews.com/2023/03/from-ransomware-to-cyber-espionage-55.html

https://www.mandiant.com/resources/blog/zero-days-exploited-2022

https://www.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report

https://www.tenable.com/blog/cve-2022-42475-fortinet-patches-zero-day-in-fortios-ssl-vpns

https://www.tenable.com/blog/cve-2022-42475-fortinet-patches-zero-day-in-fortios-ssl-vpns

Details

Source: Mitre, NVD

Published: 2023-01-02

Updated: 2023-11-07

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical