CVE-2022-29054
At a glance Severity LOW 3.1 EPSS EPSS 0.17 % · percentile 7 (2026-10-27) State PUBLISHED Published 2023-02-16 Updated 2024-10-22 Assigner fortinet NVD status Modified Description A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
Scores Version Score Vector Scored by CVSS 3.1 LOW 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:X fortinet CVSS 3.1 LOW 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N NVD · psirt@fortinet.com (Secondary) CVSS 3.1 LOW 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.1.0 ≤ 1.1.6cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.2.0 ≤ 1.2.13cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.11cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.8cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.16cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.11cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.8cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*Affected products Product Versions Fortinet · FortiOS affected 7.2.0 ; affected 7.0.0 ≤ 7.0.7 ; affected 6.4.0 ≤ 6.4.9 ; affected 6.2.0 ≤ 6.2.12 ; affected 6.0.0 ≤ 6.0.16 Fortinet · FortiProxy affected 7.2.0 ≤ 7.2.1 ; affected 7.0.0 ≤ 7.0.7 ; affected 2.0.0 ≤ 2.0.11 ; affected 1.2.0 ≤ 1.2.13 ; affected 1.1.0 ≤ 1.1.6
References
Sources
