CVE-2022-42475
CriticalActively exploited (CISA KEV)Known to be used in ransomware campaigns
Description
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Fortinet FortiOS
PublishedJan 2, 2023
First seenJan 2, 2023
Added to KEVDec 13, 2022
Weakness typeCWE-197CWE-197
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jan 3, 2023Update
- fortinet fortios6.0.16, 6.2.12, 6.4.11, 7.0.9, 7.2.3, 6.0.15, 6.4.10, 7.0.8 or later
- fortinet fortiproxy2.0.12, 7.0.8, 7.2.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortios | 5.0.0 ≤ v ≤ 5.0.14, 5.2.0 ≤ v ≤ 5.2.15, 5.4.0 ≤ v ≤ 5.4.13, 5.6.0 ≤ v ≤ 5.6.14, 6.0.0 ≤ v < 6.0.16, 6.2.0 ≤ v < 6.2.12, 6.4.0 ≤ v < 6.4.11, 7.0.0 ≤ v < 7.0.9, 7.2.0 ≤ v < 7.2.3, 6.0.0 ≤ v < 6.0.15, 6.4.0 ≤ v < 6.4.10, 7.0.0 ≤ v < 7.0.8 | 6.0.16, 6.2.12, 6.4.11, 7.0.9, 7.2.3, 6.0.15, 6.4.10, 7.0.8 |
| fortinet fortiproxy | 1.0.0 ≤ v ≤ 1.0.7, 1.1.0 ≤ v ≤ 1.1.6, 1.2.0 ≤ v ≤ 1.2.13, 2.0.0 ≤ v < 2.0.12, 7.0.0 ≤ v < 7.0.8, 7.2.0 ≤ v < 7.2.2 | 2.0.12, 7.0.8, 7.2.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.