CVE-2022-42475
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Description
CVE-2022-42475 is a critical heap-based buffer overflow vulnerability in Fortinet's FortiOS and FortiProxy SSL-VPN components. An unauthenticated remote attacker can exploit this flaw by sending specially crafted requests to the SSL-VPN interface, achieving arbitrary code execution on the affected device. With a maximum CVSS score of 9.8 (Critical) and confirmed active exploitation in the wild, CVE-2022-42475 has been listed in CISA's Known Exploited Vulnerabilities catalog and is associated with known ransomware campaigns. The EPSS score of 0.94 (99th percentile) further underscores the exceptionally high likelihood of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | >= 5.0.0, <= 5.0.14; >= 5.2.0, <= 5.2.15; >= 5.4.0, <= 5.4.13; >= 5.6.0, <= 5.6.14; >= 6.0.0, < 6.0.16; >= 6.2.0, < 6.2.12; >= 6.4.0, < 6.4.11; >= 7.0.0, < 7.0.9; >= 7.2.0, < 7.2.3; >= 6.0.0, < 6.0.15; >= 6.4.0, < 6.4.10; >= 7.0.0, < 7.0.8 |
| fortinet | fortiproxy | >= 1.0.0, <= 1.0.7; >= 1.1.0, <= 1.1.6; >= 1.2.0, <= 1.2.13; >= 2.0.0, < 2.0.12; >= 7.0.0, < 7.0.8; >= 7.2.0, < 7.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/psirt/FG-IR-22-398(Exploit, Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42475(US Government Resource)
Weakness Type
CWE-197: Numeric Truncation Error
Numeric truncation errors occur when a value is stored in a data type that is too small to hold it, causing the value to be silently truncated. In the context of CVE-2022-42475, this weakness class contributes to improper size calculations that can lead to the heap-based buffer overflow in FortiOS's SSL-VPN processing code.
Learn more: CWE-197 — Numeric Truncation Error
CWE-787: Out-of-bounds Write
Out-of-bounds write vulnerabilities occur when software writes data past the boundaries of allocated memory. In FortiOS SSL-VPN, the heap-based buffer overflow triggered by CVE-2022-42475 allows an attacker to overwrite adjacent memory on the heap, enabling control flow hijacking and ultimately arbitrary code or command execution on the firewall appliance.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
Confidentiality Impact: High — successful exploitation of CVE-2022-42475 enables an attacker to read sensitive configuration data, VPN credentials, encryption keys, and internal network information stored on or passing through the FortiGate appliance. Integrity Impact: High — arbitrary code execution on the firewall device allows attackers to modify system configurations, install persistent backdoors, manipulate routing rules, or alter security policies to facilitate further network intrusion. Availability Impact: High — exploitation can crash the FortiOS SSL-VPN service or the entire device, disrupting VPN connectivity for all users and potentially cutting off remote access to the corporate network. Scope: The vulnerability is contained within the FortiOS/FortiProxy device context (Scope Unchanged), but compromising a perimeter VPN appliance grants attackers a pivotal foothold for lateral movement into the internal network. Attack Prerequisites: CVE-2022-42475 requires no authentication and no user interaction. An attacker only needs network access to the SSL-VPN interface, which is typically exposed to the internet, making this vulnerability trivially exploitable by remote threat actors.
Exploit Maturity
Active Exploitation: Fortinet confirmed that CVE-2022-42475 was actively exploited in the wild prior to the disclosure of the vulnerability, with threat actors leveraging it to deploy malware and establish persistent access on FortiGate devices. KEV Catalog Status: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of January 3, 2023, reflecting the urgency of the threat. EPSS Score: The EPSS score of 0.94 (99th percentile) indicates an extremely high probability of exploitation, placing it among the most actively targeted vulnerabilities tracked. Ransomware Association: CVE-2022-42475 has a confirmed association with ransomware operations. Threat groups have used this vulnerability as an initial access vector to compromise networks before deploying ransomware payloads. Historical Context: This vulnerability was exploited by advanced persistent threat actors, including groups attributed to nation-state operations, who used it to compromise government and critical infrastructure networks worldwide.
Remediation
- Immediately upgrade FortiOS to a patched version: 7.2.3 or later, 7.0.9 or later, 6.4.11 or later, 6.2.12 or later, or 6.0.16 or later, depending on your current branch.
- Upgrade FortiProxy to version 7.2.2 or later, or 7.0.8 or later.
- If immediate patching is not possible, disable the SSL-VPN feature on the FortiGate device until the update can be applied.
- Review FortiGate device logs for indicators of compromise, including unexpected system file modifications, anomalous outbound connections, or unauthorized configuration changes.
- Consult Fortinet's advisory FG-IR-22-398 at https://fortiguard.com/psirt/FG-IR-22-398 for detailed mitigation guidance and indicators of compromise.
- Implement network segmentation to limit the blast radius of a compromised perimeter device and restrict management access to trusted internal networks only.
- Ensure compliance with CISA's remediation deadline if subject to Binding Operational Directive 22-01.
Technical Details
Vulnerability Mechanism: CVE-2022-42475 is a heap-based buffer overflow in the SSL-VPN component of FortiOS and FortiProxy. The flaw stems from improper bounds checking when processing incoming SSL-VPN requests. When a specially crafted request exceeds the expected buffer size, data overflows into adjacent heap memory, corrupting control structures and allowing the attacker to redirect execution flow. CVSS Vector Analysis: The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with a perfect base score of 9.8 reflects the worst-case attack profile: network-accessible, low complexity, no privileges required, and no user interaction needed. All three impact categories are rated High, consistent with full device compromise. Exploitation Pathway: An attacker identifies an internet-exposed FortiGate appliance with SSL-VPN enabled. They send carefully crafted HTTPS requests to the SSL-VPN interface that trigger the heap-based buffer overflow. By controlling the overflow data, the attacker overwrites function pointers or other critical heap metadata, gaining the ability to execute arbitrary code or system commands with the privileges of the FortiOS process — typically root-level access on the appliance. Affected Versions: FortiOS 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, and 6.0.15 and earlier. FortiProxy 7.2.0 through 7.2.1 and 7.0.7 and earlier. Contributing Weakness: The CWE-197 (Numeric Truncation Error) classification suggests that an integer or size value used in buffer allocation or length calculations is truncated, resulting in an undersized buffer that is subsequently overflowed when processing full-length input data.
Frequently Asked Questions
What is CVE-2022-42475?
CVE-2022-42475 is a critical heap-based buffer overflow vulnerability in the SSL-VPN component of Fortinet FortiOS and FortiProxy. It allows an unauthenticated remote attacker to execute arbitrary code or commands by sending specially crafted requests.
How critical is CVE-2022-42475?
With a CVSS score of 9.8 (Critical), this is one of the most severe vulnerabilities possible. It requires no authentication, no user interaction, and has low attack complexity. It has been actively exploited in the wild and linked to ransomware campaigns.
Is CVE-2022-42475 used in ransomware attacks?
Yes, CISA has confirmed that CVE-2022-42475 is associated with known ransomware campaigns. Threat actors have used this vulnerability as an initial access vector to breach networks and subsequently deploy ransomware.
Which FortiOS versions are affected?
FortiOS versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, and 6.0.15 and earlier are affected. FortiProxy versions 7.2.0 through 7.2.1 and 7.0.7 and earlier are also vulnerable.
How do I mitigate CVE-2022-42475?
Upgrade FortiOS and FortiProxy to the latest patched versions. If patching is not immediately possible, disable the SSL-VPN feature on the device. Review Fortinet's advisory FG-IR-22-398 for specific indicators of compromise and additional mitigation steps.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.