cve-2022-42475-Fortinet

cve-2022-42475 POC code to exploit the Heap overflow in Fortinet's SSLVPN daemon Usage pip install pwntools To use this code, you can save it in a file, say exploit.py, and then run it with Python in the command line, passing in the required arguments. Here's an example command to run the exploit...

cve-2022-42475

cve-2022-42475 POC code to exploit the Heap overflow in Fortinet's SSLVPN daemon Notes This is a quick and dirty POC that will probably not work anywhere unless you are extremely lucky. It is version dependent and contains some hardcoded offsets which will most likely change from one system to...

cve-2022-42475

FortiOS SSL-VPN buffer overflow vulnerability cve-2022-42475 https://nvd.nist.gov/vuln/detail/CVE-2022-42475 POC code to exploit the Heap overflow in Fortinet's SSLVPN daemon Notes This is a quick and dirty POC that will probably not work anywhere unless you are extremely lucky. It is version...

CVE-2024-24919

CVE-2024-24919 Nuclei Template to discover CVE-2024-24919. A path traversal vulnerability in CheckPoint SSLVPN. BTW. Great article, that was my inspiration to write this simple template at 2:00 AM. Resource: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/...

CVE-2026-86101 Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request...

Dlink DSR-250 and Netgear Prosafe - Cross-Site Scripting Detection

Dlink DSR-250 and Netgear Prosafe are vulnerable to reflected cross site scripting endpoint scgi-bin/platform.cgi in parameter SSLVPN. !/usr/bin/env python3 -- coding: utf-8 -- """Dlink DSR-250 and Netgear Prosafe are vulnerable to reflected cross site scripting endpoint scgi-bin/platform.""" fro...

SSL VPN Session Hijacking Detection

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. !/usr/bin/env python3 -- coding: utf-8 -- """An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to by.""" from...

Sonicwall SSLVPN - Remote Code Execution (ShellShock) Detection

Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execute arbitrary commands. !/usr/bin/env python3 -- coding: utf-8 -- """Sonicwall SSLVPN contains a 'ShellShock' vulnerability which allows remote unauthenticated attackers to execut.""" impor...

CVE-2026-4116

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication...

EUVD-2026-20906

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication...

CVE-2026-4114

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication...

CVE-2026-4114

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication...

CVE-2026-4114

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication...

CVE-2026-4116: Improper Handling of Unicode Encoding

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication...

CVE-2026-4114: Improper Handling of Unicode Encoding

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication...

VulnCheck KEV: CVE-2024-40762

Use of Cryptographically Weak Pseudo-Random Number Generator PRNG in the SonicOS SSLVPN authentication token generator that, in certain cases, can be predicted by an attacker potentially resulting in authentication bypass...

VulnCheck KEV: CVE-2025-40601

A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service DoS, which could cause an impacted firewall to crash...

CVE-2022-23989

In Stormshield Network Security SNS before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to the SSLVPN service might lead to saturation of the loopback interface. This could result in the blocking of almost all network traffic, maki...

CVE-2019-7487

Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution...

CVE-2025-62631: Insufficient Session Expiration

An insufficient session expiration vulnerability CWE-613 vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's passwor...