Week in review: Citrix and Fortinet RCEs, Microsoft fixes exploited zero-day

A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device. This vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol traffic to an affected device. A successful exploit could allow the attacker to cause a stack overflow, resulting in possible remote code execution or a denial of service (DoS) condition on an affected device.

CVE-2022-27518 is a critical flaw in Citrix Application Delivery Controller (ADC) and Gateway firmware that permits unauthenticated remote arbitrary code execution, which CISA characterizes as an authentication bypass. It is triggered remotely over the network with no credentials, privileges, or user interaction required (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, score 9.8), so any affected appliance with an internet-reachable interface is a potential target. A successful attacker gains code execution on the appliance and access to sensitive resources, which is especially dangerous on VPN gateway and load-balancing deployments that front-door enterprise networks. All organizations running Citrix ADC or Gateway appliances are potentially affected, with internet-exposed devices at greatest risk. The flaw is being actively exploited in the wild, including by state-sponsored actors; it was added to CISA KEV on 2022-12-13 and Citrix and the NSA publicly urged admins to patch, though no public proof-of-concept is known.

Do: Apply the fixed firmware updates per Citrix's vendor instructions immediately, prioritizing internet-facing ADC and Gateway appliances, since the flaw is in CISA KEV and actively exploited by state-sponsored actors. Until patched, restrict or shield appliance interfaces where feasible, and review internet-exposed devices for indicators of compromise given the absence of a public PoC.

CVE-2022-42475 is a critical (CVSS 9.8) heap-based buffer overflow in the SSL-VPN service of Fortinet FortiOS and FortiProxy. A remote, unauthenticated attacker can trigger it by sending specifically crafted requests to an exposed SSL-VPN interface, with no user interaction or credentials required. Successful exploitation yields arbitrary code or command execution on the appliance, giving attackers a foothold on the perimeter device from which they can pivot into internal networks. Any organization running the listed FortiOS (6.0 through 7.2) or FortiProxy (7.0/7.2) versions with SSL-VPN enabled is affected. Exploitation is confirmed in the wild: the flaw is in CISA KEV with known ransomware use, has near-certain exploitation probability (EPSS 99.5%), and has been used in targeted government attacks and a Chinese-nexus espionage campaign that compromised over 20,000 systems, with attackers also noted to retain access even after patching.

Do: Upgrade FortiOS and FortiProxy to fixed releases per Fortinet advisory FG-IR-22-398 (any version beyond the listed affected ranges), and reboot the appliance after patching to clear lingering SSL-VPN sessions since attackers have been observed retaining access post-patch. Check for indicators of compromise such as unknown local accounts, unexpected processes, and anomalous historical logins, and rotate SSL-VPN credentials if compromise is suspected. If SSL-VPN is not required, disable it or restrict exposure to trusted sources until patched.

CVE-2022-44698 is a security feature bypass in Microsoft Defender SmartScreen in which specially crafted files do not properly trigger the SmartScreen Mark-of-the-Web warning prompt. The flaw is triggered over the network but requires user interaction: an attacker typically delivers a crafted file via a malicious link or phishing email, and when the user clicks or opens it, SmartScreen fails to show its usual warning. An attacker gains the ability to run malicious content on a user's machine without the standard SmartScreen prompt, making the flaw an effective delivery and initial-access aid — it has documented use in ransomware campaigns. Anyone running the affected Windows releases is exposed: Windows 10 versions 1607 through 22H2, Windows 11 21H2, and Windows Server 2016, 2019, and 2022. The vulnerability was exploited as a zero-day before patching, was added to CISA's Known Exploited Vulnerabilities catalog on 2022-12-13 with known ransomware use, and Google reported a ransomware gang abusing it in the wild.

Do: Apply Microsoft's December 2022 security updates (or any later cumulative updates) for Windows 10, Windows 11, and Windows Server, prioritizing user workstations and systems exposed to phishing or web downloads, per the CISA KEV required action. Until patched, reinforce user awareness that downloaded files may not trigger the usual SmartScreen warning, and consider restricting download or execution of risky file types. Confirm remediation against CISA KEV guidance and treat this as high-priority given known ransomware exploitation.