VULNERABILITY INTELLIGENCE
CVE-2022-40684
CVSS score9.8 CRITICAL
EPSS probability99.98%
CISA KEVKnown exploited vulnerability
Published2022-10-18
Last modified2026-08-06
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
Fortinet Multiple Products Authentication Bypass Vulnerability
Vendor / product: Fortinet / Multiple Products
Description
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Weakness classification
- nvd@nist.gov: CWE-287
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-287
Primary references
- psirt@fortinet.com — Exploit, Third Party Advisory, VDB Entry
- psirt@fortinet.com — Exploit, Third Party Advisory, VDB Entry
- psirt@fortinet.com — Mitigation, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource