CVE-2022-42475

VendorfortinetProductfortios, fortiproxyDiscoveredJan 2, 2023UpdatedOct 24, 2025

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

View graph Watch Export

CVSS v3.1

9.8 CRITICAL

EPSS

99.5%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Connections

4 relationships

CWE-197

source

Timeline

disclosure → media coverage

Jan 2, 2023

Disclosure — published as a CVE record. · last revised by NVD Oct 24, 2025

Sep 15, 2026

securityweek.com reports: Thai Broadband Provider Hacked via Fortinet Vulnerability

Public PoC (9)

github.com/bryanster/ioc-cve-2022-42475 github.com/scrt/cve-2022-42475 github.com/Amir-hy/cve-2022-42475 github.com/Mustafa1986/cve-2022-42475-Fortinet github.com/P4x1s/CVE-2022-42475-RCE-POC github.com/natceil/cve-2022-42475 github.com/0xhaggis/CVE-2022-42475 github.com/ArthurHendrich/CVE-2022-42475-POC github.com/uLl0a/cve-2022-42475-poc

Unverified third-party code — review before executing.