CVE-2022-42475
Published 2023-01-02 · Updated 2026-06-17 · Source psirt@fortinet.com
Summary
CVE-2022-42475 is a critical-severity (CVSS 9.8) vulnerability in Fortinet FortiOS. CISA added it to the Known Exploited Vulnerabilities catalog on December 13, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 3, 2023. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.
All 32 known-exploited Fortinet vulnerabilities →Description
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Fortinet — FortiOS
Name: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Date added: 2022-12-13 · Due: 2023-01-03
Required action: Apply updates per vendor instructions.