Critical Zero-Day Vulnerability in FortiOS SSL-VPN

Fortinet has discovered a zero-day vulnerability in FortiOS SSL-VPN that has been exploited by unknown actors targeting government and large organizations. The identified CVE-2022-42475 vulnerability is a heap-based buffer overflow flaw that could enable an unauthenticated remote attacker to execute arbitrary code via specially crafted requests. The primary objective of the attack was to deploy a generic Linux implant modified for FortiOS, which was capable of compromising Fortinet’s intrusion prevention system (IPS) and establishing connections with a remote server to download additional malware and execute commands.