EXTERNAL PENTESTING REAL WORLD WRITE UPS BY BHEH

During an external pentesting, a critical OS Command Injection vulnerability was identified by our team in a Fortinet SSL VPN web interface, specifically through manipulation of the lang (language) parameter.

During an external pentesting, our red team identified a critical vulnerability on FortiGate 100F firewall appliances. The issue is CVE-2022-42475 – a heap-based buffer overflow in FortiOS’s SSL-VPN service that allows remote, unauthenticated code execution.