Patchfirst
Patchfirst
CVE-2022-42475 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.5%

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Fortinet · FortiOS

Summary

A heap-based buffer overflow in the SSL-VPN component of Fortinet's FortiOS (and FortiProxy) allows the flaw to be triggered by specifically crafted requests. A remote attacker with no authentication and no user interaction, reaching the SSL-VPN over the network, could execute arbitrary code or commands on the affected device.

Official description · NVD

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Breakdown
88.8 / 100
Exploited
Yes, in CISA KEV
Reports
4
Tactics
5/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

  3. What can follow

First seen exploited 21 days before it was disclosed. Public exploit code (PoC-in-GitHub) appeared 15 days after disclosure.

  1. First seen exploitedVulnCheck KEV evidence21 days before
  2. Added to CISA KEVknown ransomware use; EU database agrees20 days before
  3. Disclosedday 0
  4. Public exploit codePoC-in-GitHub+15 days
  5. Named in a threat reportctrlaltintel.com+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

4 , grouped by in kill-chain order 4

Initial AccessTA0001

Exploit Public-Facing Application T1190
MITRE CTID mapping of the KEV entry · how it is exploited

CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device. This malicious software has observed anti-debugging and command and control capabilities (over HTTP).

ExecutionTA0002

Hijack Execution Flow T1574 also Stealth
MITRE CTID mapping of the KEV entry · primary impact

Stealth

Debugger Evasion T1622 also Discovery
MITRE CTID mapping of the KEV entry · follow-on activity

Command and ControlTA0011

Web Protocols T1071.001
MITRE CTID mapping of the KEV entry · follow-on activity

Detection

1 rule for this CVE · 200 general rules for its techniques

Rules for this CVE

1 that reference CVE-2022-42475 directly.

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Hijack Execution FlowT15748 general rules
Debugger EvasionT16221 general rule
Web ProtocolsT1071.00142 general rules
All 42 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 4 threat reports
4 reportsctrlaltintel.comGoogle Mandiantpicussecurity.com+1Mar 2026 · 3 undated

Reports are matched by finding the exact id CVE-2022-42475 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

fortiguard.com/psirt/FG-IR-22-398

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42475
↑ ↓ chooseEnter openEsc close