VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Oct 18, 2022· Updated Aug 6, 2026

CVE-2022-40684

CVE-2022-40684

Description

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • Fortinet/Fortiproxy3 versions
    cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.7
    • cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
    • (no CPE)range: 7.2.0, 7.0.0 - 7.0.6
  • Fortinet/Fortiswitchmanager4 versions
    cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:fortinet:fortiswitchmanager:7.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:fortinet:fortiswitchmanager:7.2.0:*:*:*:*:*:*:*
    • (no CPE)range: 7.2.0, 7.0.0
    • (no CPE)range: FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0
  • Fortinet/Fortios2 versions
    cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*range: >=7.0.0,<7.0.7
    • (no CPE)range: 7.2.0 - 7.2.1, 7.0.0 - 7.0.6

Patches

Vulnerability mechanics

References

4

News mentions

2