Fortinet Fixes Critical Zero-Day RCE Vulnerability

2 min. read
By Laura Libeer

⚡ TL;DR | Go Straight to the Fortinet Vulnerability Report

Fortinet has released a number of emergency patches in response to a critical heap-based buffer overflow bug in FortiOS SSL-VPN. They are already aware of this vulnerability being exploited in the wild. An unauthenticated attacker could exploit the bug to execute arbitrary code. This could in turn lead to system crashes or allow a malicious actor to install programs, compromise critical data, or create new accounts with full user rights.


Fortinet’s security advisory describes the vulnerability tracked as CVE-2022-42475 as “A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN” which could allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. The vulnerability received a critical CVSS score of 9.3.

The advisory also mentions that Fortinet is aware of the vulnerability being exploited in the wild. They advise all users to validate their systems for a number of indicators of compromise:

  1. Multiple log entries with:
    Logdesc="Application crashed" and msg="[...] application:sslvpnd,[...], Signal 11 received, Backtrace: [...]“
  2. Presence of the following artifacts in the filesystem:
  3. Connections to the following suspicious IP addresses from the FortiGate:,30081,30443,20443,444

Protect Vulnerable Fortinet Devices

CVE-2022-42475 affects several versions of FortiOS and FortiOS-6K7K. In order to protect your devices from attackers, they should be updated to the patched versions as soon as possible. You can find a list of all affected versions and the patched versions below.

ProductAffected VersionsUpdate to
FortiOS7.2.0 through or above
7.0.0 through or above
6.4.0 through or above
6.2.0 through or above
FortiOS-6K7K7.0.0 through or above
6.4.0 through or above
6.2.0 through or above
6.0.0 through or above

Discover Vulnerable Fortinet Devices

Our team at Lansweeper has created a special report, to help you find any Fortinet devices in your network that may be vulnerable to the vulnerability described above. The report will give you an actionable list of devices that may still need to be updated.

Fortinet Vulnerability Audit December 2022

Ready to get started?
You’ll be up and running in no time.

Explore all our features, free for 14 days.