Skip to content

Defense Digests

FortiOS SSL-VPN Vulnerability Discovered

Dataprise Defense Digest 550x550

Table of content

Dataprise Defense Digest

Severity: 9 (High)

Published: December 12th, 2022


A vulnerability has been discovered in Fortinet’s FortiOS SSL VPN system. This vulnerability could allow an unauthenticated attacker to execute code remotely on the Fortinet VPN which could give them root-level access to the appliance. Fortinet is urging all customers to be aware of this vulnerability.

Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analysis of these vulnerabilities and the potential impact to our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions.

If your organization’s Fortinet appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts. Additionally, the Dataprise Cybersecurity team has implemented detection rules in our SIEM to identify any attempts to exploit any Fortinet SSL VPNs that are being monitored by our SOC under a Managed Security Services plan.


The vulnerability disclosure is new and is still being investigated to fully understand the impact, however, all customers should be aware of this vulnerability and should ensure all vulnerable Fortinet appliances are running an up-to-date version of FortiOS SSL-VPN server and client. A list of affected versions has been enumerated below.


This remote code execution vulnerability has been identified as a memory exploitation in the FortiOS code. Researchers and security teams have observed attackers exploiting this vulnerability in the wild. Indicators of Compromise are:

  • Log Entries:
    Logdesc=”Application crashed” and msg=”[…] application:sslvpnd,[…], Signal 11 received, Backtrace: […]“
  • IP Addresses:
    • 188.34.130[.]40:444
    • 103.131.189[.]143:30080,30081,30443,20443
    • 192.36.119[.]61:8443,444
    • 172.247.168[.]153:8033
  • Files Left After Successful Exploitation:



Fortinet urges all customers to update to the latest version for FortiOS from the following vulnerable versions:

  • FortiOS version 7.2.0 through 7.2.2
  • FortiOS version 7.0.0 through 7.0.8
  • FortiOS version 6.4.0 through 6.4.10
  • FortiOS version 6.2.0 through 6.2.11
  • FortiOS-6K7K version 7.0.0 through 7.0.7
  • FortiOS-6K7K version 6.4.0 through 6.4.9
  • FortiOS-6K7K version 6.2.0 through 6.2.11
  • FortiOS-6K7K version 6.0.0 through 6.0.14



  • Susan Verdin, Cybersecurity Analyst
  • Stephen Jones, VP Cybersecurity

Recent Tweets


Learn about the latest threats and vulnerabilities with our D3 alerts.

Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.