PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2022-42475] Hàng ngàn thiết bị sử dụng FortiOS và FortiProxy chưa cập nhật bản vá cho các lỗ hổng bảo mật nghiêm trọng - Phần II

blog.viettelcybersecurity.com | vulnerability | CVE-2022-42475 | #rce | #heap-overflow | #fortinet | #ssl-vpn | #fortios | #cve-2022-42475 | #fortiproxy
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part II details CVE-2022-42475, a heap buffer overflow in Fortinet's SSL-VPN (sslvpnd) from integer overflow in Content-Length handling, allowing unauthenticated RCE on FortiOS/FortiProxy.
CVE
CVE-2022-42475
Published
Collected

Related coverage

vulnerability · bishopfox.com
A More Complete Exploit for Fortinet CVE-2022-42475
Bishop Fox's Team X details a more complete exploit for CVE-2022-42475—the FortiGate SSL VPN heap overflow exploited in the wild—covering ROP chains, shellcode, and per-appliance targeting.
vulnerability · bishopfox.com
Building an Exploit for FortiGate Vulnerability CVE-2023-27997
Bishop Fox walks through building a proof-of-concept exploit for CVE-2023-27997, a pre-auth heap buffer overflow in Fortinet's SSL VPN, covering the flawed length check and jemalloc heap grooming.
blog · blog.viettelcybersecurity.com
Hàng ngàn thiết bị sử dụng FortiOS và FortiProxy chưa cập nhật bản vá cho các lỗ hổng bảo mật nghiêm trọng - Phần I
Part I warns that thousands of exposed FortiOS/FortiProxy devices remain unpatched against critical unauthenticated RCE flaws (CVE-2023-33308, CVE-2023-27997, CVE-2022-42475, CVE-2022-40684).
vulnerability · bishopfox.com
CVE-2023-27997 Is Exploitable, and 69% of FortiGate Firewalls Are Vulnerable
Bishop Fox built a working exploit for CVE-2023-27997, a FortiOS SSL VPN heap overflow allowing RCE, and found nearly 490,000 exposed interfaces via Shodan—roughly 69% unpatched.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
vulnerability · horizon3.ai
FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)
Fortinet recently patched a critical authentication bypass vulnerability that gives an attacker the ability to login as an administrator,
Back