← CVE Radar
CVE-2022-40684Fortinet Multiple Products Authentication Bypass Vulnerability
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
9.8 CRITICALEPSS 99.98%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.8 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C |
CISA required action
⚡ Known exploited · remediation due Nov 1, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2022-40684
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Oct 18, 2022
- Last modified
- 2026-08-06 05:16 UTC
Affected Products
As published by the CNA in the CVE record.
FortinetFortinet FortiOS, FortiProxy, FortiSwitchManager1 version range
- FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0
References
- packetstormsecurity.com http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html
- packetstormsecurity.com http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
- fortiguard.com https://fortiguard.com/psirt/FG-IR-22-377
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684