FortiOS heap-based buffer overflow vulnerability

This live blog contains information regarding the FortiOS heap-based buffer overflow vulnerability. As soon as we have an update, we’ll add it to this post. More information about possible risks and details can be found at the bottom of this blog. Last updated on December 27, 2022.

Update December 27, 2022

14:00 | Fortinet has updated their initial Advisory and has added several new products and versions of products to the list of affected products. Products newly added to the list compared to our previous advisory are:

• FortiOS version 6.0.0 through 6.0.15
• FortiOS version 5.6.0 through 5.6.14
• FortiOS version 5.4.0 through 5.4.13
• FortiOS version 5.2.0 through 5.2.15
• FortiOS version 5.0.0 through 5.0.14
• FortiProxy version 7.2.0 through 7.2.1
• FortiProxy version 7.0.0 through 7.0.7
• FortiProxy version 2.0.0 through 2.0.11
• FortiProxy version 1.2.0 through 1.2.13
• FortiProxy version 1.1.0 through 1.1.6
• FortiProxy version 1.0.0 through 1.0.7

Fortinet has published security patches to mitigate the vulnerability for the added FortiOS and FortiProxy products. It is advised to apply these security patches as soon as possible.

As the vulnerability is already exploited in the wild, you should consider your device compromised, if it is not patched at this moment. Fortinet has published several indicators of compromise which can be used to determine potential exploitation of the vulnerability.

Update December 13, 2022

14:00 | On the 12th of December 2022, Fortinet published an Advisory in which they describe CVE-2022-42475. This vulnerability is a heap-based buffer overflow in the FortiOS SSL-VPN allowing an unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Fortinet quietly fixed CVE-2022-42475 on November 28 in FortiOS 7.2.3 and published other versions even earlier to mitigate the vulnerability in the FortiOS SSL-VPN. However, they published the information about the Zero-Day on the 12th of December. It is advised to apply these security patches as soon as possible. Fortinet is aware of an instance where this vulnerability was exploited in the wild. Therefore, in addition to the security patches, Fortinet has shared indicators of compromise (IOCs). It is advised to check FortiOS SSL-VPN systems for the presence of the shared IOCs.