CVE-2022-35843
En bref Sévérité HIGH 7.7 EPSS EPSS 0.95 % · centile 61 (2026-10-27) État PUBLISHED Publiée 2022-12-06 Mise à jour 2024-10-23 Attribuée par fortinet Statut NVD Modified Description An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.
Scores Version Score Vecteur Évalué par CVSS 3.1 HIGH 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C fortinet CVSS 3.1 HIGH 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · psirt@fortinet.com (Secondary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.2.0 ≤ 1.2.13cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.10cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.6cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 ≤ 6.0.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 ≤ 6.2.12cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.9cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.7cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*Produits affectés Produit Versions Fortinet · FortiOS affected 7.2.0 ; affected 7.0.0 ≤ 7.0.6 ; affected 6.4.0 ≤ 6.4.9 ; affected 6.2.0 ≤ 6.2.12 ; affected 6.0.0 ≤ 6.0.15 ; affected 6.2.0 < 6.2.* Fortinet · FortiProxy affected 7.0.0 ≤ 7.0.5 ; affected 2.0.0 ≤ 2.0.10 ; affected 1.2.0 ≤ 1.2.13
Références
Sources
