Post-exploitation activities in Fortinet FortiGate (April 11, 2025)

unknownpublic exploitCVE-2022-42475 CVE-2023-27997 CVE-2024-21762

Fortinet published a blog post on April 10, 2025, indicating the use of a post-exploitation technique that allows for a breach of data confidentiality across the entire system of affected Fortigate devices. This technique relies on the use of a link...

CSIRTS triage

vendor: Fortinet product: FortiGate Information disclosure

What: A post-exploitation technique allows for a breach of data confidentiality.
Who is affected: Users of affected FortiGate devices.
Urgency: Remediation is urgent as exploitation is confirmed.
Action: Follow Fortinet's guidance to secure affected devices.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch FortiGate

Get an email when a new FortiGate advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2025-04-11
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2025-ALE-004/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2022-42475EPSS puts this in the most-targeted tier (99.5% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
Exploitation likely imminentCVE-2023-27997EPSS puts this in the most-targeted tier (85.7% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
Exploitation likely imminentCVE-2024-21762EPSS puts this in the most-targeted tier (83.4% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2022-42475	coverage & exploitation status	NVD · CVE.org
CVE-2023-27997	coverage & exploitation status	NVD · CVE.org
CVE-2024-21762	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownexploitedA method to assess 'forgivable' vs 'unforgivable' vulnerabilitiesncsc-uk
unknownexploited[Update] Vulnerability in Fortinet FortiOS (February 9, 2024)cert-fr-alerte
criticalexploitedCVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerabilitycisa-kev
criticalexploitedCVE-2023-27997: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerabilitycisa-kev
criticalexploitedCVE-2022-42475: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerabilitycisa-kev