CVE-2022-42475

What it actually does

CVE-2022-42475 is a remotely reachable heap-based buffer overflow in the FortiOS and FortiProxy SSL-VPN service. A specially crafted request to the SSL-VPN interface can corrupt heap memory and allow an unauthenticated attacker to execute arbitrary code or commands with the privileges of the vulnerable VPN process. Because the vulnerable service is commonly exposed to the internet and exploitation requires no credentials or user interaction, successful exploitation can provide an attacker with a foothold on the perimeter device, enabling credential theft, persistence, traffic interception, lateral movement support, configuration theft, and service disruption.

Why it matters to the business

This vulnerability affects internet-facing Fortinet VPN and proxy infrastructure, which often protects remote access into corporate networks. It has a critical CVSS score, very high EPSS likelihood, confirmed exploitation in the wild, CISA KEV listing, and reported ransomware use, making unpatched systems high-priority targets. A compromised device can expose VPN users, internal routing and policy information, authentication material, and trusted network access paths, potentially leading to broader intrusion, ransomware deployment, outage of remote access services, regulatory exposure, and incident response costs. CISA’s KEV remediation deadline was 2023-01-03, so any remaining exposure should be treated as overdue and urgent.

How an attack unfolds

An attacker scans the internet for exposed FortiOS or FortiProxy SSL-VPN portals running affected versions. The attacker sends a malformed SSL-VPN request designed to trigger heap corruption in the SSL-VPN daemon. If exploitation succeeds, the attacker gains code execution on the appliance without needing valid VPN credentials. Post-exploitation activity may include dropping files or shared objects on the appliance, modifying or reading configuration data, establishing outbound command-and-control, stealing VPN/session/authentication data, creating persistence, and using the trusted VPN edge position to support access into internal networks. Public reporting and vendor guidance indicate this vulnerability has been exploited in the wild, including in activity associated with ransomware risk, so defenders should assume exposed unpatched systems may have been targeted.

How to fix it

Upgrade affected Fortinet products to fixed releases immediately. For FortiOS, upgrade to FortiOS 7.2.3 or later, 7.0.9 or later, 6.4.11 or later, or 6.2.12 or later, depending on the supported branch in use. For FortiProxy, upgrade to FortiProxy 7.2.2 or later or 7.0.8 or later. If immediate upgrade is not possible, disable SSL-VPN until patched, restrict SSL-VPN access to trusted source IP ranges where operationally feasible, and monitor aggressively for crash logs and post-exploitation artifacts. Because this vulnerability is exploited in the wild, patching alone is not sufficient for devices that were previously exposed while vulnerable; perform compromise assessment, review device configuration, rotate potentially exposed credentials and secrets, invalidate active VPN sessions, and consider rebuilding or factory-resetting appliances where indicators of compromise are found.

How to confirm the fix worked

Confirm the device is no longer running an affected FortiOS or FortiProxy version and that the SSL-VPN service has restarted cleanly after upgrade. Validate branch-specific target versions: FortiOS 7.2.3+, 7.0.9+, 6.4.11+, or 6.2.12+; FortiProxy 7.2.2+ or 7.0.8+. Review administrative GUI and CLI version output, asset inventory, vulnerability scanner results, and external attack-surface scans for exposed SSL-VPN portals. Confirm SSL-VPN exposure is either patched, disabled, or access-restricted. Check system and event logs for prior sslvpnd crashes, suspicious files on the appliance, unexpected configuration changes, unknown admin accounts, anomalous VPN logins, and outbound connections from the appliance. If any evidence of exploitation exists, validate remediation through incident-response procedures rather than relying only on version verification.

Typical attack path

1. Identify internet-facing FortiOS or FortiProxy SSL-VPN services.
2. Fingerprint vulnerable FortiOS or FortiProxy versions through banners, portal behavior, or known device exposure data.
3. Send a specially crafted unauthenticated request to the SSL-VPN interface to trigger the heap-based buffer overflow.
4. Achieve arbitrary code or command execution in the context of the SSL-VPN process.
5. Stage malicious files, shared libraries, scripts, or configuration changes on the appliance.
6. Collect VPN, authentication, configuration, routing, or policy information from the device.
7. Establish persistence or outbound command-and-control from the perimeter appliance.
8. Use the compromised VPN edge to facilitate credential abuse, internal reconnaissance, lateral movement, data theft, or ransomware deployment.

How to detect it

Review FortiGate and FortiProxy event logs, system logs, crash logs, VPN authentication logs, administrative audit logs, configuration backups, and network telemetry for signs of exploitation. Key evidence includes sslvpnd process crashes, especially segmentation faults or Signal 11 events, followed by unexpected filesystem changes, new or modified shared libraries, suspicious outbound connections, unknown administrative activity, or unusual VPN authentications. Look for crash entries around the time of inbound SSL-VPN requests from unknown internet sources. Inspect the appliance filesystem for vendor-reported suspicious files and unexpected libraries under /data/lib or hidden configuration backup files. Review configuration diffs for newly created local users, altered admin profiles, changed automation scripts, new trusted hosts, modified SSL-VPN settings, and unexpected static routes or policies. Network detection should focus on outbound traffic initiated by the appliance to unfamiliar external IPs, uncommon ports, or infrastructure not normally contacted by perimeter devices. Because exploitation has been observed in the wild, absence of a crash log is not definitive proof of safety; correlate logs with firmware history, exposure windows, VPN session records, EDR/NDR telemetry behind the VPN, and identity logs for downstream activity after suspicious appliance events.

• application:sslvpnd
• Signal 11 received
• Logdesc="Application crashed"
• msg="application:sslvpnd"
• /data/lib/libips.bak
• /data/lib/libgif.so
• /data/lib/libiptcp.so
• /data/lib/libipudp.so
• /data/lib/libjepg.so
• /var/.sslvpnconfigbk
• /data/etc/wxd.conf
• sslvpnd crashed
• sslvpnd

What your security team should do

• Immediately identify all FortiOS and FortiProxy appliances with SSL-VPN enabled and confirm whether they are running affected versions.
• Patch or upgrade exposed devices to the fixed FortiOS or FortiProxy releases without delay; this vulnerability is KEV-listed, actively exploited, and associated with ransomware risk.
• If patching cannot be completed immediately, disable SSL-VPN or restrict access to trusted source IP ranges as a temporary control.
• Perform compromise assessment on any device that was internet-exposed while vulnerable, including review of crash logs, filesystem artifacts, configuration changes, admin accounts, VPN activity, and outbound connections.
• Rotate credentials and secrets that may have been exposed through the VPN appliance, including local admin passwords, VPN user credentials, API keys, certificates where appropriate, and integrations using the appliance as a trust anchor.
• Review VPN authentication logs for unusual successful logins, impossible travel, new source geographies, disabled MFA events, and activity outside normal business patterns.
• Hunt for suspicious outbound traffic from Fortinet appliances to unknown external IPs or uncommon ports, especially after sslvpnd crash events.
• Where compromise is suspected, preserve forensic evidence, isolate the appliance, engage incident response, and rebuild or factory-reset the device from trusted firmware and known-good configuration.
• Add external attack-surface monitoring for Fortinet SSL-VPN exposure and alert on reintroduction of vulnerable versions or internet-wide access.
• Prioritize this issue above routine patching due to unauthenticated remote code execution, high exploit probability, active exploitation, KEV status, and ransomware association.