{"id":"CVE-2022-42475","kind":"vulnerability","aliases":["CVE-2022-42475"],"related":[],"title":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8,…","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","summary":"Fortinet FortiOS SSL-VPN has a heap-based buffer overflow that lets an unauthenticated remote attacker run arbitrary code or commands on the appliance via crafted requests. CISA lists it as actively exploited in the wild and tied to ransomware campaigns.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2022-12-13T00:00:00+00:00","products":[{"name":"fortinet fortios","fixed":[],"affected":">= 5.0.0, <= 5.0.14","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 5.2.0, <= 5.2.15","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 5.4.0, <= 5.4.13","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 5.6.0, <= 5.6.14","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["6.0.16"],"affected":">= 6.0.0, < 6.0.16","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["6.2.12"],"affected":">= 6.2.0, < 6.2.12","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["6.4.11"],"affected":">= 6.4.0, < 6.4.11","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.0.9"],"affected":">= 7.0.0, < 7.0.9","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.2.3"],"affected":">= 7.2.0, < 7.2.3","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 1.0.0, <= 1.0.7","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 1.1.0, <= 1.1.6","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 1.2.0, <= 1.2.13","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["2.0.12"],"affected":">= 2.0.0, < 2.0.12","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.0.8"],"affected":">= 7.0.0, < 7.0.8","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.2.2"],"affected":">= 7.2.0, < 7.2.2","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["6.0.15"],"affected":">= 6.0.0, < 6.0.15","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["6.4.10"],"affected":">= 6.4.0, < 6.4.10","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.0.8"],"affected":">= 7.0.0, < 7.0.8","ecosystem":"vendor"},{"name":"Fortinet FortiOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortigate","fortios","infrastructure","network-appliance","ransomware","ssl-vpn"],"not_affected_if":["non-fortios-devices","ssl-vpn-disabled"],"how_to_check":"Check whether the SSL-VPN feature is enabled on the FortiGate and which FortiOS version is running (the sources do not give exact affected version ranges).","fix":"Apply the FortiOS update per Fortinet's vendor advisory (the sources do not name the fixed version).","status":"open","published_at":"2022-12-13T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:53+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:08:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the FortiOS update per Fortinet's vendor advisory (the sources do not name the fixed version).\nunknown","reach":"internet","impact":"high","summary":"Fortinet FortiOS SSL-VPN has a heap-based buffer overflow that lets an unauthenticated remote attacker run arbitrary code or commands on the appliance via crafted requests. CISA lists it as actively exploited in the wild and tied to ransomware campaigns.","category":"infrastructure","who_cares":["fortios","fortigate","ssl-vpn","network-appliance"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the firewall, taking over the appliance","analyst_note":"Find the affected and fixed FortiOS version ranges and the exact mitigation steps in Fortinet's PSIRT advisory for CVE-2022-42475, and confirm the SSL-VPN dependency.","how_to_check":"Check whether the SSL-VPN feature is enabled on the FortiGate and which FortiOS version is running (the sources do not give exact affected version ranges).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["ssl-vpn-disabled","non-fortios-devices"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000521,"input_tokens":2836,"output_tokens":475,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-122':9A,127C '-2022':22A,25A '-42475':23A,26A '6.0.15':145C '6.2.0':142C '6.2.11':144C '6.4.0':139C '6.4.10':141C '7.0.0':18A,136C '7.0.7':156C '7.0.8':20A,138C '7.2.0':15A,133C,153C '7.2.1':155C '7.2.2':17A,135C 'activ':109B 'allow':160C 'applianc':71B,101B 'arbitrari':95B,167C 'attack':93B,164C 'base':4A,85B,122C 'buffer':5A,86B,123C 'campaign':118B 'cisa':105B 'code':96B,168C 'command':98B,170C 'craft':103B,173C 'cve':21A,24A 'cwe':8A,126C 'earlier':147C,158C 'execut':166C 'exploit':65B,110B 'fortig':66B 'fortinet':27A,29A,31A,33A,35A,37A,39A,41A,43A,45A,47A,49A,51A,53A,55A,57A,59A,61A,63A,76B 'fortio':11A,67B,77B,129C 'fortios':28A,30A,32A,34A,36A,38A,40A,42A,44A,58A,60A,62A,64A 'fortiproxi':149C 'fortiproxy':46A,48A,50A,52A,54A,56A 'heap':3A,84B,121C 'heap-bas':2A,83B,120C 'infrastructur':68B 'let':89B 'list':106B 'may':159C 'network':70B 'network-appli':69B 'overflow':6A,87B,124C 'ransomwar':72B,117B 'remot':92B,162C 'request':104B,174C 'run':94B 'specif':172C 'ssl':13A,74B,79B,131C,151C 'ssl-vpn':12A,73B,78B,130C,150C 'tie':115B 'unauthent':91B,163C 'via':102B,171C 'vpn':14A,75B,80B,132C,152C 'vulner':7A,125C 'wild':113B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-12-13T00:00:00+00:00","kev":{"dateAdded":"2022-12-13","dueDate":"2023-01-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-42475","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-42475","severity":null,"published_at":"2022-12-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T20:35:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-42475","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42475","severity":null,"published_at":"2023-01-02T09:15:09+00:00","modified_at":"2026-06-17T05:04:59+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}