VYPR
← All advisories
High severity8.1NVD Advisory· Published Dec 6, 2022· Updated Jun 17, 2026

CVE-2022-35843

CVE-2022-35843

Description

An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.

Affected products

8
  • Fortinet/Fortiproxy3 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: >=1.2.0,<=1.2.13
    • (no CPE)range: 7.0.0-7.0.5, 2.0.0-2.0.10, 1.2.x
    • (no CPE)range: 7.0.0
  • Fortinet/Fortios5 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=6.0.0,<=6.0.15
    • cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*
    • cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*
    • (no CPE)range: 7.2.0, 7.0.0-7.0.7, 6.4.0-6.4.9, 6.2.x, 6.0.x
    • (no CPE)range: 7.2.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.