⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2023-01-03.

CVE-2022-42475 — Numeric Truncation Error in Fortinet Fortios

CWE-197 — Numeric Truncation ErrorCWE-787 — Out-of-bounds Write14 documents12 sources
Severity
9.8CRITICALNVD
EPSS
94.0%
top 0.11%
CISA KEV
KEVRansomware
Added 2022-12-13
Due 2023-01-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Fortinet FortiosFortinet Fortiproxy
Timeline
KEV addedDec 13
PublishedJan 2
KEV dueJan 3
Latest updateJan 11
CISA Required Action: Apply updates per vendor instructions.

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

▶NVDfortinet/fortios6.0.0 — 6.0.16+11
▶NVDfortinet/fortiproxy2.0.0 — 2.0.12+5
▶CVEListV5fortinet/fortios7.2.0 — 7.2.2+8
▶CVEListV5fortinet/fortiproxy7.2.0 — 7.2.1+5

🔴Vulnerability Details

3
CVEList
CVE-2022-42475: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7↗2023-01-02
▶
GHSA
GHSA-p3vq-4cxh-gfp9: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7↗2023-01-02
▶
VulnCheck
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability↗2022
▶

💥Exploits & PoCs

1
Nuclei
Fortinet SSL-VPN - Heap-Based Buffer Overflow
▶

📋Vendor Advisories

2
Fortinet
Heap-based buffer overflow in sslvpnd↗2023-01-02
▶
CISA
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability↗2022-12-13
▶

🕵️Threat Intelligence

4
Fortinet
Analysis of FG-IR-22-398 – FortiOS - heap-based buffer overflow in SSLVPNd | Fortinet Blog↗2023-01-11
▶
Recorded Future
CVE-2022-42475: Fortinet Pre-authentication Code-execution Vulnerability | Recorded Future↗
▶
Huntress
CVE-2022-42475 Vulnerability: Analysis, Impact, Mitigation | Huntress↗
▶
Recorded Future
CVE-2022-42475: Fortinet Pre-authentication Code-execution Vulnerability↗
▶

📐Framework References

1
ATT&CK
BOLDMOVE↗
▶
CVE-2022-42475 — Numeric Truncation Error in Fortinet | cvebase