Fortinet · Multiple Products
CVE-2022-40684
Fortinet Multiple Products Authentication Bypass Vulnerability
무엇인가
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CISA: Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 11월 1일
Fortinet의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 16. | Path Traversal | Multiple Products | 보통 5.4 | 1.3% |
| 2026. 9. 9. | Heap-based Buffer Overflow | Multiple Products | 높음 7.4 | 3.7% |
| 2026. 1. 27. | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | 치명적 9.4 | 87% |
| 2025. 12. 16. | Improper Verification of Cryptographic Signature | Multiple Products | 치명적 9.1 | 68% |
| 2025. 5. 14. | Stack-Based Buffer Overflow | Multiple Products | 치명적 9.6 | 31% |
| 2024. 10. 9. | Format String | Multiple Products | 치명적 9.8 | 62% |
| 2026. 10. 1. | Path Traversal | FortiMail | 치명적 9.8 | 4.6% |
| 2026. 7. 27. | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | 보통 5.3 | 29% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.