CVE-2022-42475

The critical zero-day vulnerability, CVE-2022-42475, was discovered in FortiGate firewalls during an incident investigation by the vendor. This flaw in software design or implementation allows an unauthenticated attacker to execute arbitrary code on affected systems. The vulnerability is present in multiple versions of Fortinet's FortiOS and FortiProxy technologies. The discovery was made when researchers from the company found malware tied to this vulnerability in a public repository in December. The vulnerability was exploited by attackers aiming at accessing an unclassified military research network. It was reported that Chinese spies used the vulnerability in FortiGate appliances to deploy the Coathanger remote access Trojan (RAT) on Dutch defense networks. Other advanced persistent threat (APT) groups also exploited this heap-based buffer overflow vulnerability in FortiOS SSL-VPN to establish presence on targeted organizations' Fortinet firewall devices. US Cyber Command’s Cyber National Mission Force, the Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation released a joint security alert warning that multiple government-backed hackers exploit vulnerabilities in Zoho ManageEngine ServiceDesk Plus and Fortinet firewalls to compromise targeted organizations. Researchers have published a report on a suspected China-nexus espionage campaign exploiting the FortiOS SSL-VPN vulnerability as early as October 2022. It remains unclear if the threat actor is tied to another intrusion group that was observed exploiting the same vulnerability in early January to install a Linux implant.