← CVE Radar
CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
9.3 CRITICALEPSS 99.47%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.3 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C |
Details
- CVE ID
- CVE-2022-42475
- Status
- Published
- Assigner (CNA)
- fortinet
- Published
- Jan 2, 2023
- Last modified
- 2025-10-21 23:15 UTC
- Weaknesses
- CWE-197 · Execute unauthorized code or commands
Affected Products
As published by the CNA in the CVE record.
FortinetFortiProxy6 version ranges
- 7.2.0 through 7.2.1
- 7.0.0 through 7.0.7
- 2.0.0 through 2.0.11
- 1.2.0 through 1.2.13
- 1.1.0 through 1.1.6
- 1.0.0 through 1.0.7
FortinetFortiOS9 version ranges
- 7.2.0 through 7.2.2
- 7.0.0 through 7.0.8
- 6.4.0 through 6.4.10
- 6.2.0 through 6.2.11
- 6.0.0 through 6.0.15
- 5.6.0 through 5.6.14
- 5.4.0 through 5.4.13
- 5.2.0 through 5.2.15
- 5.0.0 through 5.0.14
References
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS