According to its investigation, the attacks were complex and highly targeted at “governmental or government-related targets.” On January 11, Fortinet’s product security incident response team published additional information about the attacks targeting CVE-2022-42475, including indicators of compromise. The blog from Olympe Cyberdefense goes further, stating attackers could gain “full control.” A remote, unauthenticated attacker could exploit this vulnerability with a specially crafted request and gain code execution. AnalysisĬVE-2022-42475 is a heap-based buffer overflow in several versions of ForiOS that received a CVSSv3 score of 9.3. Fortinet’s language implies this exploitation was limited in scope, specifying “an instance.” It is unclear whether Fortinet observed this exploitation directly or if it was reported to them by the researchers. On December 9 Olympe Cyberdefense published a brief summary of a vulnerability affecting several versions of Fortinet FortiOS used in its FortiGate secure socket layer virtual private network (SSL VPN) and firewall products.įortinet followed up on December 12 with an advisory which elaborated that the vulnerability has been observed under exploitation. Update January 12: The Analysis section has been updated based on a technical write up from Fortinet PSIRT.

Fort firewall