FortiOS SSL-VPN Heap Overflow RCE
- Product
- Fortinet FortiOS SSL-VPN (sslvpnd)
- CVE
- CVE-2022-42475
- Disclosed
- 2022-12-12
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- FortiOS 7.2.0-7.2.2, 7.0.0-7.0.8, 6.4.0-6.4.10, 6.2.0-6.2.11, 6.0.0-6.0.15, 5.x; FortiProxy 7.2.0-7.2.1, 7.0.0-7.0.7, 2.0.x, 1.x.
- Fixed
- FortiOS 7.2.3, 7.0.9, 6.4.11, 6.2.12, 6.0.16; FortiProxy 7.2.2, 7.0.8.
Summary
A heap overflow in the FortiGate SSL-VPN daemon allowed unauthenticated attackers to run code on the firewall. It was exploited as a zero-day by a China-nexus actor that deployed custom implants (BoldMove) against government targets.
Root cause
sslvpnd mishandled a length value derived from an HTTP request when allocating and copying data, producing a heap-based buffer overflow. Because sslvpnd runs as a privileged process on a platform without strong exploit mitigations, the overflow could be turned into code execution.
Impact
Unauthenticated code execution on the firewall, enabling persistent implants and traffic interception.
Detection
Fortinet published IOCs: sslvpnd crash entries in event logs and files such as /data/lib/libips.bak or /var/.sslvpnconfigbk. Check FortiOS versions; scanners exist for version fingerprinting.
Mitigation
Upgrade FortiOS; disable SSL-VPN if it cannot be patched immediately.