Fortinet · Multiple Products
CVE-2022-40684
Fortinet Multiple Products Authentication Bypass Vulnerability
Qué es
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CISA: Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 1 de noviembre de 2022
Más fallos explotados de Fortinet
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 16 oct 2026 | Path Traversal | Multiple Products | Media 5,4 | 1,3% |
| 9 sept 2026 | Heap-based Buffer Overflow | Multiple Products | Alto 7,4 | 3,7% |
| 27 ene 2026 | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | Crítica 9,4 | 87% |
| 16 dic 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Crítica 9,1 | 68% |
| 14 may 2025 | Stack-Based Buffer Overflow | Multiple Products | Crítica 9,6 | 31% |
| 9 oct 2024 | Format String | Multiple Products | Crítica 9,8 | 62% |
| 1 oct 2026 | Path Traversal | FortiMail | Crítica 9,8 | 4,6% |
| 27 jul 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Media 5,3 | 29% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.