PatchSiren

PatchSiren cyber security CVE debrief

CVE-2018-13383 Fortinet CVE debrief

CVE-2018-13383 is an out-of-bounds write affecting Fortinet FortiOS and FortiProxy. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-10 and marked known ransomware campaign use as "Known". Defenders should prioritize the vendor-recommended update path and verify that affected Fortinet deployments are remediated.

Vendor
Fortinet
Product
FortiOS and FortiProxy
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-01-10
Original CVE updated
2022-01-10
Advisory published
2022-01-10
Advisory updated
2022-01-10

Who should care

Security teams responsible for Fortinet FortiOS or FortiProxy, especially vulnerability management, network security, and incident response teams tracking KEV-listed issues.

Technical summary

The supplied sources identify CVE-2018-13383 as an out-of-bounds write in Fortinet FortiOS and FortiProxy. The CISA KEV record classifies it as a known exploited vulnerability and notes known ransomware campaign use. No additional exploit mechanics or impact details are included in the supplied corpus.

Defensive priority

High. KEV inclusion means the vulnerability is known to be exploited in the wild, and CISA set a remediation due date of 2022-07-10. Fortinet operators should treat patching as a priority.

Recommended defensive actions

  • Apply updates per vendor instructions for FortiOS and FortiProxy.
  • Confirm which systems, appliances, or instances run the affected Fortinet products and versions.
  • Prioritize remediation for assets that still lack the KEV-listed fix.
  • Validate that updates completed successfully and record the remediation status.
  • Use compensating controls until affected systems are updated, where immediate patching is not possible.

Evidence notes

Evidence is limited to the supplied CISA KEV record and the official CVE/NVD links. The KEV entry names the issue as an out-of-bounds write in Fortinet FortiOS and FortiProxy, states that known ransomware campaign use is "Known", and directs users to apply vendor updates. The supplied corpus does not include CVSS scoring or deeper technical exploitation details.

Official resources

CVE published and modified: 2022-01-10. CISA added the vulnerability to KEV on 2022-01-10 and set a remediation due date of 2022-07-10. The supplied corpus does not include the original vendor disclosure date.