Out-of-bounds write in Fortinet FortiProxy
Priority CRITICAL 100Exploited in the wildCWE-197Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
Why it matters now
Exploitation Active In CISA KEV since 2022-12-13CISA due date 2023-01-03Known ransomware use
EPSS 0.99474 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fortinet | FortiProxy | 7.2.0 – 7.2.1; 7.0.0 – 7.0.7; 2.0.0 – 2.0.11; 1.2.0 – 1.2.13; 1.1.0 – 1.1.6; 1.0.0 – 1.0.7 | — | No fix listed | CNA |
| Fortinet | FortiOS | 7.2.0 – 7.2.2; 7.0.0 – 7.0.8; 6.4.0 – 6.4.10; 6.2.0 – 6.2.11; 6.0.0 – 6.0.15; 5.6.0 – 5.6.14; 5.4.0 – 5.4.13; 5.2.0 – 5.2.15; 5.0.0 – 5.0.14 | — | No fix listed | CNA |
- FortiProxy VendorFortinet Affected 7.2.0 – 7.2.1; 7.0.0 – 7.0.7; 2.0.0 – 2.0.11; 1.2.0 – 1.2.13; 1.1.0 – 1.1.6; 1.0.0 – 1.0.7 Fixed in — No fix listed CNA
- FortiOS VendorFortinet Affected 7.2.0 – 7.2.2; 7.0.0 – 7.0.8; 6.4.0 – 6.4.10; 6.2.0 – 6.2.11; 6.0.0 – 6.0.15; 5.6.0 – 5.6.14; 5.4.0 – 5.4.13; 5.2.0 – 5.2.15; 5.0.0 – 5.0.14 Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | 5.0.0 – 5.0.14; 5.2.0 – 5.2.15; 5.4.0 – 5.4.13; 5.6.0 – 5.6.14; 6.0.0 to before 6.0.16; 6.2.0 to before 6.2.12; 6.4.0 to before 6.4.11; 7.0.0 to before 7.0.9; 7.2.0 to before 7.2.3 | Vulnerable | Fortinet |
| cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | 1.0.0 – 1.0.7; 1.1.0 – 1.1.6; 1.2.0 – 1.2.13; 2.0.0 to before 2.0.12; 7.0.0 to before 7.0.8; 7.2.0 to before 7.2.2 | Vulnerable | Fortinet |
| cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | 6.0.0 to before 6.0.15; 6.4.0 to before 6.4.10; 7.0.0 to before 7.0.8 | Vulnerable | Fortinet |
| cpe:2.3:h:fortinet:fim-7901e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fim-7904e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fim-7910e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fim-7920e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fim-7921f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fim-7941f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6300f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
- cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.0.14; 5.2.0 – 5.2.15; 5.4.0 – 5.4.13; 5.6.0 – 5.6.14; 6.0.0 to before 6.0.16; 6.2.0 to before 6.2.12; 6.4.0 to before 6.4.11; 7.0.0 to before 7.0.9; 7.2.0 to before 7.2.3 Vulnerable ·Fortinet
- cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.0.7; 1.1.0 – 1.1.6; 1.2.0 – 1.2.13; 2.0.0 to before 2.0.12; 7.0.0 to before 7.0.8; 7.2.0 to before 7.2.2 Vulnerable ·Fortinet
- cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.15; 6.4.0 to before 6.4.10; 7.0.0 to before 7.0.8 Vulnerable ·Fortinet
- cpe:2.3:h:fortinet:fim-7901e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fim-7904e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fim-7910e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fim-7920e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fim-7921f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fim-7941f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6300f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:fortinet:fortigate-6300f-dc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6500f-dc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6501f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6501f-dc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6601f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-6601f-dc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-7030e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-7040e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-7060e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fortigate-7121f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fpm-7620e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fpm-7620f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
| cpe:2.3:h:fortinet:fpm-7630e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fortinet |
- cpe:2.3:h:fortinet:fortigate-6300f-dc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6500f-dc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6501f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6501f-dc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6601f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-6601f-dc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-7030e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-7040e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-7060e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fortigate-7121f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fpm-7620e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fpm-7620f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
- cpe:2.3:h:fortinet:fpm-7630e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fortinet
Remediation
No fixed version listed by the sources yet.
Timeline
- 2022-12-13 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2022-42475
- 2026-10-03 Alias added: GHSA-p3vq-4cxh-gfp9
References
More Fortinet Fortios vulnerabilities
- TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
- TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
- TI-2024-36904 Authentication bypass in Fortinet FortiOS KEVCVSS 3.1CRITICAL 9.8
- TI-2024-15234 A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through… KEVCVSS 3.1CRITICAL 9.8
- TI-2024-14448 Out-of-bounds write in Fortinet FortiOS KEVCVSS 3.1CRITICAL 9.8
- TI-2023-12585 Heap-based buffer overflow in Fortinet FortiOS-6K7K KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-42475 · CVE Program
- CVE-2022-42475 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-p3vq-4cxh-gfp9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences