BlackTreeCVE IntelligenceFortinet · FortiOS
Official source article: Siemens SSA-770770 ↗. Check the applicable product and release in the original source.
CISA confirms exploitation in the wild and lists 2023-01-03 as the remediation due date. Verified remediation exists for at least one product or source, but 1 structured product or package state remain unresolved. Apply remediation only to the exact product branch confirmed by its source.
Verified remediation exists for at least one product or source, but 1 structured product or package state remain unresolved. Apply remediation only to the exact product branch confirmed by its source.
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
The vendor explicitly identifies these products as affected by this CVE.
CISA confirms exploitation in the wild and lists 2023-01-03 as the remediation due date. Verified remediation exists for at least one product or source, but 1 structured product or package state remain unresolved. Apply remediation only to the exact product branch confirmed by its source.
Fix availability varies by productMultiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2022-12-13. Known ransomware campaign use is recorded.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-197: Numeric Truncation Error. Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:CCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 2 Jan 2023 · Last source change 21 Oct 2025, 23:15 UTC · CWE-197 · Numeric Truncation Error
Core structured fields are present and their contributing authorities are shown above.