PT-2022-5820 · Fortinet · Fortiproxy Ssl-Vpn+1

Published 2022-12-12 · Updated 2026-04-21 · CVE-2022-42475

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.15 and earlier FortiOS versions 6.2.0 through 6.2.11 FortiOS versions 6.4.0 through 6.4.10 FortiOS versions 7.0.0 through 7.0.8 FortiOS versions 7.2.0 through 7.2.2 FortiProxy SSL-VPN versions 7.0.7 and earlier FortiProxy SSL-VPN versions 7.2.0 through 7.2.1

Description A heap-based buffer overflow vulnerability in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. The vulnerability has been exploited by Chinese state-sponsored hackers to infect over 20,000 devices, including those in the Dutch Ministry of Defense. The attackers used the vulnerability to deploy malware, including the COATHANGER RAT, and gain unauthorized access to networks. The estimated number of potentially affected devices worldwide is significant, with the vulnerability being exploited in various incidents.

Recommendations For FortiOS versions 6.0.15 and earlier: Update to a patched version or disable SSL-VPN as a temporary workaround. For FortiOS versions 6.2.0 through 6.2.11: Update to a patched version or disable SSL-VPN as a temporary workaround. For FortiOS versions 6.4.0 through 6.4.10: Update to a patched version or disable SSL-VPN as a temporary workaround. For FortiOS versions 7.0.0 through 7.0.8: Update to a patched version or disable SSL-VPN as a temporary workaround. For FortiOS versions 7.2.0 through 7.2.2: Update to a patched version or disable SSL-VPN as a temporary workaround. For FortiProxy SSL-VPN versions 7.0.7 and earlier: Update to a patched version or disable SSL-VPN as a temporary workaround. For FortiProxy SSL-VPN versions 7.2.0 through 7.2.1: Update to a patched version or disable SSL-VPN as a temporary workaround.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-197

CWE-122

Related Identifiers

BDU:2022-07226

CVE-2022-42475

Affected Products

Fortios

Fortiproxy Ssl-Vpn

References · 201

• 🔥 https://github.com/scrt/cve-2022-42475 · Exploit
• 🔥 https://github.com/0xhaggis/CVE-2022-42475 · Exploit
• 🔥 https://github.com/3yujw7njai/CVE-2022-42475-RCE-POC · Exploit
• 🔥 https://github.com/CKevens/CVE-2022-42475-RCE-POC · Exploit
• 🔥 https://github.com/Amir-hy/cve-2022-42475 · Exploit
• 🔥 https://fortiguard.com/psirt/FG-IR-22-398 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42475 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42475 · Security Note
• https://bdu.fstec.ru/vul/2022-07226 · Security Note
• https://github.com/cisagov/ScubaGear · Note
• https://github.com/sandialabs/gait · Note
• https://t.me/thehackernews/6654 · Telegram Post
• https://twitter.com/ShanHolo/status/1911011047172968798 · Twitter Post
• https://twitter.com/matthewjetthall/status/1699800941334003900 · Twitter Post