Quick Answer — CVE-2022-42475 was a CVSS 9.8 pre-authentication heap buffer overflow in FortiOS SSL-VPN — the edge appliance that enterprises bet their remote access on. Fortinet first patched quietly in late November 2022, then on December 12 confirmed exploitation in the wild by an actor later linked to Chinese state-nexus espionage per reporting. The lesson: your SSL-VPN is tier-0 attack surface, pre-auth memory-safety bugs in it are instant emergencies, and quiet patching is not disclosure.
What happened
- The bug. A heap-based buffer overflow in the SSL-VPN daemon reachable before authentication. Crafted requests corrupt heap management structures; skilled attackers convert that to remote code execution as SYSTEM/root on the appliance.
- The silent patch. Fortinet shipped fixes in FortiOS 7.2.3 etc. on November 28, 2022 with minimal description — no CVE, no “exploited” language. Researchers and attackers alike diffed.
- The disclosure. December 6: Charles Fol (synacktiv) published technical analysis showing the patched path was an unauthenticated, trivially reachable overflow. December 9: CVE published (9.8). December 12: Fortinet’s PSIRT updated advisories to confirm exploitation in the wild had been observed.
- The actor. Fortinet’s advisory included IOCs (custom malware, log tampering, file drops). Reporting and later advisories tied exploitation to a China-nexus espionage actor; attribution hedged throughout.
Why SSL-VPN pre-auth bugs are extreme
| Property | Consequence |
|---|---|
| Internet-exposed by design | No recon needed; the attack surface is the product |
| Pre-auth reachability | No credentials, no MFA, no logs of failed logins — the crash path precedes all of it |
| Memory-unsafe CGI stack | Skilled actors get code execution, not just crashes |
| Traffic decrypt role | Post exploitation: session tokens, plaintext visibility, lateral movement |
| Single-vendor fleet ops | One CVE = simultaneous enterprise-wide risk |
The exploitation trail (per advisories and reporting)
- Custom malware families deposited on appliances, including file-collection and tunnel tools; some tailored to FortiGate environments.
- Log tampering to hide access — defenders must treat appliance self-logs as potentially incomplete post-compromise.
- Config and session-data theft: attackers harvested settings and, in some reporting, SSL-VPN session tokens enabling quiet re-entry.
- Webshells/plain scripts in rare cases; persistence varied by victim.
Timeline
| Date | Event |
|---|---|
| 2022-11-28 | Firmware patched silently (7.0.x/7.2.x etc.) |
| 2022-12-06 | Synacktiv technical analysis of the overflow |
| 2022-12-09 | CVE-2022-42475 published, CVSS 9.8 |
| 2022-12-12 | PSIRT update: exploitation in the wild confirmed + IOCs |
| 2023 → 2025 | Dutch MIVD and others report state-nexus exploitation follow-through; Fortinet ships IOC updates; patch-gap scanning persists for years |
Hardening beyond patching
- Treat appliances as hosts. EDR equivalents for network gear: config integrity checks, out-of-band logging (syslog to immutable store), and file-change alarm.
- Rate-limit and geo-fence the VPN portal. Pre-auth bugs meet fewer hostile packets when the portal isn’t world-reachable.
- Assume token compromise post-incident. Force re-auth for all sessions after patching an exploited fleet; rotate any embedded credentials.
- Diff vendor silent patches. When a vendor ships a security fix without a CVE, your risk clock already started — mirror firmware-analysis researchers.
- Architect for disposal. Appliances should be re-imageable from known-good in hours, with configs backed up out-of-band.
Why it still matters in 2026
FortiGate SSL-VPN CVEs (42475 and successors) became a pillar of CISA’s exploited-in-the-wild catalogs and an enduring lesson in edge memory safety. The incident also solidified the modern norm that “patch available” ≠ “risk disclosed”: silent firmware updates created an intelligence gap where malware authors diffed faster than defenders. In 2026’s environment of runaway appliance exploitation (Ivanti, Citrix, PAN-OS…), the December 2022 Fortinet sequence reads as the template: quiet patch → researcher disclosure → CVE → in-the-wild confirmation → IOCs → year-long tail of unpatched edges. Enterprises that learned it run edge-attack-surface programs — inventories, virtual-patch WAF rules during patch windows, and post-patch compromise hunts — not just patch queues.
Was CVE-2022-42475 actually exploited before the CVE?
Likely yes, in limited fashion — Fortinet’s own advisory timeline and later reporting on the espionage actor suggest probing and some intrusions during the silent-patch window, though the public “exploited in the wild” confirmation came December 12. The defensible statement: patch was available before disclosure, and exploitation both preceded and followed the CVE publication, per vendor advisories and subsequent government reporting.
Could MFA have stopped it?
No — pre-auth means the vulnerability’s execution path completes before MFA is ever consulted. MFA protects the session that follows; it does nothing for the heap corruption that precedes it. This asymmetry is why SSL-VPN edge bugs are classified as “unauthenticated RCE-class” regardless of the auth policies behind them.
What should defenders do if they had an unpatched FortiGate in the window?
Patch first, then hunt: audit configs against known-good exports; review out-of-band logs (not the appliance’s own, which may be tampered); rotate all credentials and session tokens stored or terminated at the appliance; and check the IOCs Fortinet published in the December 12 advisory and its updates — custom malware artifacts, persistence files, and anomalous admin accounts. Where suspicion remains, rebuild the firmware from scratch rather than trusting the running image.
Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.
