CVE DatabaseCVE-2022-42475

Updated 2026-06-17한국어 권고문 →

CVE-2022-424759.8/CRITICALCISA KEVCWE-197CWE-787

Fortinet FortiOS and FortiProxy SSL-VPN Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2022-42475) Security Advisory

⚡ Jump to Patch

Affected Vendors

fortinet

Affected Components

fortios, fortiproxy

Published Date

2023-01-02

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.5%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

Impact

An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

Mitigation

Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

Affected Products & Version Scope

FortiOS 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier / FortiProxy 7.2.0 to 7.2.1, 7.0.7 and earlier

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is upgrading to the patched firmware versions. Access the FortiOS CLI and execute the following commands to verify the current version and perform the upgrade.

bash

# Check current firmware version
get system status

# Restore/Upgrade firmware image via TFTP server (Example)
execute restore image tftp FortiOS_7.2.3.out 192.168.1.99

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, disable the SSL-VPN service entirely or restrict access to trusted IP addresses using local-in policies.

bash

# Disable SSL-VPN service
config vpn ssl settings
    set status disable
end

# Restrict SSL-VPN access to trusted IP ranges using local-in policy
config firewall local-in-policy
    edit 1
        set intf 'wan1'
        set srcaddr 'TRUSTED_IP_RANGE'
        set dstaddr 'all'
        set action accept
        set service 'SSL-VPN-PORT'
        set schedule 'always'
    next
    edit 2
        set intf 'wan1'
        set srcaddr 'all'
        set dstaddr 'all'
        set action deny
        set service 'SSL-VPN-PORT'
        set schedule 'always'
    next
end

3. Log Audit & IoC Verification Commands

To check for potential compromise, inspect the system logs for abnormal sslvpnd process crashes and monitor active connections.

bash

# Search for sslvpnd process crash logs
show log eventfilter
execute log filter category 1
execute log filter field subtype system
execute log display | grep -i 'crash'

# Monitor active connections and system processes
diagnose sys top 2 50
diagnose sys connection filter dport 10443
diagnose sys connection list

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediately upgrade FortiOS to 7.2.3, 7.0.9, 6.4.11, 6.2.12 or higher.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-42475) is a critical heap-based buffer overflow (CWE-122/CWE-787) in the SSL-VPN daemon (sslvpnd) of Fortinet FortiOS and FortiProxy. The root cause lies in improper input validation and potential type conversion issues (CWE-197) when processing incoming SSL-VPN connection requests. This allows an attacker to write data beyond the allocated heap buffer size, corrupting adjacent memory blocks and hijacking the execution flow.

2. Exploitation Mechanics & Attack Scenario

An attacker targets the exposed SSL-VPN port (typically TCP 10443 or 443) of a vulnerable device. Without requiring any authentication, the attacker transmits a crafted HTTP request containing malicious headers or payloads. When the sslvpnd process parses this request, it triggers a heap overflow, allowing the attacker to overwrite function pointers in memory and execute arbitrary shellcode with administrative (root) privileges. This vulnerability has been actively exploited in the wild by advanced threat actors and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

Fortigate firewalls and FortiProxy appliances serve as critical perimeter security gateways. Compromising these devices grants attackers an initial foothold inside the corporate network. This can lead to lateral movement, credential harvesting, internal traffic sniffing, and deployment of ransomware, posing a catastrophic risk to business continuity and data confidentiality.

Official Vendor Advisories & References

NVD Original English Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

https://fortiguard.com/psirt/FG-IR-22-398

Source: psirt@fortinet.com · Exploit, Mitigation, Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-398

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Mitigation, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42475

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2022-42475)

FAQ

Q1. How critical is CVE-2022-42475 and is it actively exploited in the wild?

CVE-2022-42475 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-42475?

Primary impacted vendors include fortinet across fortios, fortiproxy. Scope summary: FortiOS 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier / FortiProxy 7.2.0 to 7.2.1, 7.0.7 and earlier

Q3. What temporary mitigations or workarounds exist for CVE-2022-42475 before patching?

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION