Vulnerabilitymedium

Symbolic Link trick lets attackers bypass FortiGate patches, Fortinet warns

Security Affairsby @securityaffairsApr 12, 2025 · 17:17 UTC (Apr 12, 2025)2 min read2 · 1 read

Read at securityaffairs.com

Analyze CVE-2022-42475 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2022-42475 CVE-2023-27997 CVE-2024-21762

Tags: cve-2022-42475 cve-2023-27997 cve-2024-21762 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-42475	Unauthenticated Heap Overflow in Fortinet FortiOS/FortiProxy SSL-VPN (Critical RCE)	9.8	99%	KEVRansomwarePoC	Jan 2, 2023 KEV Dec 13, 2022
CVE-2023-27997	Pre-Auth Heap Buffer Overflow RCE in Fortinet FortiOS/FortiProxy SSL-VPN	9.8	86%	KEVRansomware	Jun 13, 2023 KEV Jun 13, 2023
CVE-2024-21762	Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy	9.8	85%	KEVRansomware	Feb 9, 2024 KEV Feb 9, 2024

From the original article

2 min read at securityaffairs.com

Fortinet warns attackers can keep read-only access to FortiGate devices even after the original vulnerability is patched. Fortinet warns that threat actors can retain read-only access to FortiGate devices even after the original vulnerability used for the breach has been patched.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.