Fortinet Patches Zero Day in FortiOS SSL VPNs (CVE-2022-42475)

On December 12 Fortinet published an advisory for a vulnerability affecting several versions of FortiOS used in its FortiGate secure socket layer virtual private network (SSL VPN) and firewall products. This vulnerability was originally disclosed publicly on December 9 and Fortinet states that it has been exploited in the wild. 

CVE-2022-42475 is a heap-based buffer overflow in several versions of ForiOS that received a CVSSv3 score of 9.3. A remote, unauthenticated attacker could exploit this vulnerability with a specially crafted request and gain code execution.

For more information, please visit our blog.