Actively exploited in the wild
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Fortinet - FortiOS · Listed in the CISA KEV since 2022-12-13. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-42475
CriticalCVSS 9.8KEVSummary
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Risk Assessment
An unauthenticated attacker could remotely execute arbitrary code or commands on the Fortinet device, leading to full system compromise.
Recommendation
Update FortiOS and FortiProxy to the latest security-patched versions.
Other vulnerabilities in FortiOS SSL-VPN
Original NVD description (English source)
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.