Exploit for Out-of-bounds Write in Fortinet Fortios

CVE-2022-42475

githubexploit · 2023-03-23

Description

Out-of-bounds Write in Fortinet Fortios CVE-2022-42475 RCE POC vulnerability. Affected versions: 2.0 <= FortiOS <= 7.2.2, 0.0 <= FortiOS <= 7.0.8, 4.0 <= FortiOS <= 6.4.10, and more. Official fix released. IOC self-check and file verification advised.

Affected Fortinet Fortios versions

Fortinet Fortios≤ 5.0.14, 5.2.15, 5.4.13, 5.6.14, 6.0.16, 6.2.12, 6.4.11, 7.0.9, 7.2.3

All known vulnerabilities by product

Fortios Fortiproxy Ssl-Vpn

CVSS 9.8 for CVE-2022-42475

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

100%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

99.5%higher than 99.9% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2024-06-26 01:15

Last Seen:2025-08-31 21:34

Reporter:CKevens

Written in:Python

Last commit:2023-03-23

Other exploits for CVE-2022-42475

Exploit for Numeric Truncation Error in Fortinet Fortios

2026-02-27 ArthurHendrichGITHUB

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

2024-11-14 node011GITHUB

Exploit for Out-of-bounds Write in Fortinet Fortios

2023-06-21 0xhaggisGITHUB

Exploit for Buffer Underflow in Fortinet Fortiweb

2023-06-17 qi4LGITHUB

Exploit for Out-of-bounds Write in Fortinet Fortiproxy

2023-06-16 rio128128GITHUB

Exploit for Out-of-bounds Write in Fortinet Fortios

2023-03-23 3yujw7njaiGITHUB

Exploit for Out-of-bounds Write in Fortinet Fortios

2023-03-22 Mustafa1986GITHUB

Exploit for Out-of-bounds Write in Fortinet Fortios

2023-03-16 Amir-hyGITHUB

Exploit Code

README42 lines

## https://sploitus.com/exploit?id=0A03C474-5159-5D12-82D2-E28FA42B84BB
# CVE-2022-42475-RCE-POC

**Vulnerability Name**  
CVE-2022-42475: FortiGate RCE vulnerability POC  

**Cause of the Vulnerability**  
Due to a flaw in the validation of user input by sslvpnd, unauthenticated attackers can trigger a buffer overflow by sending specially crafted packets, ultimately allowing them to execute arbitrary code on the target system.  

**Affected Versions**  
2.0 = 7.2.3  
FortiOS >= 7.0.9  
FortiOS >= 6.4.11  
FortiOS >= 6.2.12  
FortiOS-6K7K >= 7.0.8  
FortiOS-6K7K >= 6.4.10  
FortiOS-6K7K >= 6.2.12  
FortiOS-6K7K >= 6.0.15  

**Fix**  
The official security patch has been released to address this vulnerability. It is recommended that affected users update their systems promptly:  
https://docs.fortinet.com/product/fortigate/7.2  

**IOC Self-Inspection**  
Check whether the following log entries exist in the system:  
`Logdesc="Application crashed" and msg="[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]"`  

Check the following files in the system:  
 `/data/lib/libips.bak`  
 `/data/lib/libgif.so`  
 `/data/lib/libiptcp.so`  
 `/data/lib/libipudp.so`  
 `/data/lib/libjepg.so`  
 `/var/.sslvpnconfigbk`  
 `/data/etc/wxd.conf`  
 `/flash`  

Users can check these files using the following commands:  
`diagnose sys last-modified-files /data/lib`  
`diagnose sys last-modified-files /var/`  
`diagnose sys last-modified-files /data/etc/`  
`diagnose sys last-modified-files /flash`

Exploit Code

Share

Share on social media: