critical9.8Known exploited
CVE-2022-42475
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-12-13. Federal due date: 2023-01-03.
Apply updates per vendor instructions.
Impact
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortios | from 5.0.0 through 5.0.14 from 5.2.0 through 5.2.15 from 5.4.0 through 5.4.13 from 5.6.0 through 5.6.14 from 6.0.0 before 6.0.16 from 6.2.0 before 6.2.12 |
| Fortinet | Fortiproxy | from 1.0.0 through 1.0.7 from 1.1.0 through 1.1.6 from 1.2.0 through 1.2.13 from 2.0.0 before 2.0.12 from 7.0.0 before 7.0.8 from 7.2.0 before 7.2.2 |