Security readout for executives and security teams
Plain-English summary
This Fortinet SSL-VPN flaw lets an unauthenticated internet attacker potentially run commands on vulnerable FortiOS or FortiProxy devices. Because VPN gateways sit at the network edge, compromise can create direct business risk: unauthorized access, data exposure, service disruption, and foothold creation.
Executive priority
Immediate priority. This is a critical, unauthenticated remote code execution risk on network-edge VPN infrastructure with confirmed known exploitation. Leadership should require rapid inventory, remediation evidence, and incident review for exposed systems.
Technical view
CVE-2022-42475 is described as a heap-based buffer overflow in FortiOS and FortiProxy SSL-VPN handling. The source bundle says crafted requests may allow remote unauthenticated arbitrary code or command execution. Metadata lists critical severity and CVSS 9.3. The bundle has inconsistent CWE data, naming CWE-122 in text and CWE-197 separately.
Likely exposure
Organizations using FortiOS SSL-VPN in the listed 7.2, 7.0, 6.4, 6.2, 6.0 and earlier ranges, or FortiProxy SSL-VPN in listed 7.2 and 7.0 ranges, are most exposed, especially if internet-facing.
Exploitation context
CISA KEV listing means known exploitation is confirmed. The provided sources do not include exploit mechanics, affected campaigns, targets, or indicators. Treat exposed SSL-VPN systems as high-priority assets requiring urgent validation and vendor-guided remediation.
Researcher notes
Base analysis on Fortinet advisory and CISA KEV. Do not assume fixes beyond vendor guidance in the cited advisory. The source bundle confirms affected version ranges and exploitation status, but does not provide complete detection details or exploit telemetry.
Mitigation direction
- Follow Fortinet advisory FG-IR-22-398 for fixed versions and any temporary mitigations.
- Prioritize internet-facing FortiOS and FortiProxy SSL-VPN appliances for remediation.
- Restrict SSL-VPN exposure where business operations allow until remediation is verified.
- Review authentication, administrative, and VPN access logs for suspicious activity.
- Use CISA KEV tracking to confirm required remediation deadlines for regulated environments.
Validation and detection
- Inventory FortiOS and FortiProxy systems with SSL-VPN enabled.
- Compare running versions against the affected ranges in the CVE description.
- Confirm remediation status against Fortinet advisory FG-IR-22-398.
- Check whether vulnerable appliances were internet-facing before remediation.
- Review SSL-VPN and administrative logs for unexplained access or configuration changes.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-197: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-42475 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/psirt/FG-IR-22-398CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-42475CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Numeric Truncation Error
Numeric Truncation Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.