{"id":"CVE-2022-42475","published":"2023-01-02T09:15:09Z","modified":"2026-06-17T05:04:59Z","title":"Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"description":{"text":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier  and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","provenance":"source","from":"NVD"},"summary":{"text":"A heap-based buffer overflow in the SSL-VPN component of Fortinet's FortiOS (and FortiProxy) allows the flaw to be triggered by specifically crafted requests. A remote attacker with no authentication and no user interaction, reaching the SSL-VPN over the network, could execute arbitrary code or commands on the affected device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:01Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99474,"percentile":0.99943,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-12-13","dueDate":"2023-01-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-22-398;  https://nvd.nist.gov/vuln/detail/CVE-2022-42475","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-12-12","exploitedFirstSeen":"2022-12-12","ransomware":true,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2022-12-12"},{"url":"https://www.fortiguard.com/psirt/FG-IR-22-398","date":"2022-12-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-12-13"},{"url":"https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw","date":"2023-01-19"},{"url":"https://www.prio-n.com/a-year-in-review-2022-100-vulnerabilities-you-should-prioritize/","date":"2023-02-02"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://www.fortra.com/blog/summary-investigation-related-cve-2023-0669","date":"2023-04-17"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign","date":"2023-06-12"},{"url":"https://www.mandiant.com/resources/blog/chinese-espionage-tactics","date":"2023-07-18"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-215a","date":"2023-08-03"}],"evidenceTotal":66,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-197","name":"Numeric Truncation Error"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-398","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://fortiguard.com/psirt/FG-IR-22-398","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42475","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP).","confidence":"high"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP).","confidence":"high"},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP).","confidence":"high"},{"id":"T1622","name":"Debugger Evasion","tactics":["discovery","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2022-42475 is a remotely-expoitable heap overflow vulnerability. Adversaries have been observed exploiting this vulnerability to deliver malicious software to the target device.\n\nThis malicious software has observed anti-debugging and command and control capabilities (over HTTP).","confidence":"high"}],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2022-42475 - Fortinet FortiOS RCE","start":4518,"end":4555},{"quote":"We observed the threat actor target multiple Fortinet related CVEs (CVE-2024-55591, CVE-2024-23113 & CVE-2022-42475) in attempts to gain command execution on Edge devices.","start":6650,"end":6821}]},{"id":"SRC-d520834e84b63932946c","title":"Cloaked and Covert: Uncovering UNC3886 Espionage Operations","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","date":null,"mentions":[{"quote":"Mandiant observed the threat actor exploit CVE-2022-42475 in FortiOS's Secure Sockets Layer (SSL) virtual private network (VPN) to obtain access in January 2023 after details of the vulnerability had been made public by Fortinet as part of their vulnerability disclosure processes.","start":3688,"end":3969},{"quote":"CVE-2022-42475 allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.","start":3970,"end":4098}]},{"id":"SRC-bf1b3fd29c4a38dbdb8c","title":"Picus-RedReport-2024","publisher":"picussecurity.com","url":"https://www.picussecurity.com/hubfs/Red%20Report%202024/Picus-RedReport-2024.pdf","date":null,"mentions":[{"quote":"vulnerabilities CVE-2022-47966 and CVE-2022-42475 [22].","start":105338,"end":105393},{"quote":"[22]“Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475,”","start":373951,"end":374035}]},{"id":"SRC-35f5ad4e23c4a308e139","title":"This document is marked TLP:CLEAR. Disclosure is not limited. Sources may use TLP:CLEAR when information","publisher":"cisa.gov","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf","date":null,"mentions":[{"quote":"CVE-2022-42475 in a network perimeter FortiGate 300D firewall that was not patched.","start":22958,"end":23041},{"quote":"instance, where Volt Typhoon likely exploited CVE-2022-42475 in an unpatched Fortinet device, Volt","start":27585,"end":27683}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-45545","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45545","exploited":true,"exploitedSince":"2022-12-13","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":2,"earliest":"2023-01-17","earliestUrl":"https://github.com/bryanster/ioc-cve-2022-42475","repos":[{"name":"scrt/cve-2022-42475","url":"https://github.com/scrt/cve-2022-42475","stars":108,"created":"2023-02-23"},{"name":"0xhaggis/CVE-2022-42475","url":"https://github.com/0xhaggis/CVE-2022-42475","stars":33,"created":"2023-06-21"},{"name":"P4x1s/CVE-2022-42475-RCE-POC","url":"https://github.com/P4x1s/CVE-2022-42475-RCE-POC","stars":8,"created":"2023-03-23"},{"name":"Amir-hy/cve-2022-42475","url":"https://github.com/Amir-hy/cve-2022-42475","stars":7,"created":"2023-03-16"},{"name":"bryanster/ioc-cve-2022-42475","url":"https://github.com/bryanster/ioc-cve-2022-42475","stars":1,"created":"2023-01-17"}]},"first":{"date":"2023-01-17","source":"PoC-in-GitHub","url":"https://github.com/bryanster/ioc-cve-2022-42475"},"provenance":"source"},"detections":{"cveRules":[{"title":"Exploitation Indicator Of CVE-2022-42475","id":"293ccb8c-bed8-4868-8296-bef30e303b7e","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml","techniques":[]}]},"exploitRefs":["https://fortiguard.com/psirt/FG-IR-22-398"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1574"],"provenance":"source"},{"stage":"secondary","techniques":["T1622","T1071.001"],"provenance":"source"}],"timeline":[{"date":"2022-12-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2022-12-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-12-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45545","provenance":"source"},{"date":"2023-01-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42475","provenance":"source"},{"date":"2023-01-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/bryanster/ioc-cve-2022-42475","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":15,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":85.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1420 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":8.98,"detail":"4 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-fortinet-fortios-cwe-787"}}