Critical Fortinet Vulnerability Being Actively Exploited

Date of Notice: 12/13/2022

Action Level - Critical

Description

MCNC would like to ensure you are aware of FotiOS vulnerability that could permit a remote unauthenticated attack to execute code or commands on your device. These vulnerabilities are being actively exploited and you should verify your devices have been patched according to Fortinet’s guidance. This is being tracked as CVE-2022-42475.

Affected Devices

Attack Vector:

Attack Feasibility

This is actively being exploited, check device logs for the following Indicators of Compromise 

Multiple log entries with: 

Presence of the following artifacts in the filesystem:

Connections to suspicious IP addresses from the FortiGate:

Mitigations

The only mitigation is to disable your SSL VPN

Remediations

Update to the versions specific in the vendor documentation below:

Vendor Resources

<-- Return to Cybersecurity Alerts...