An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://fortiguard.com/psirt/FG-IR-22-255 |
History
Wed, 23 Oct 2024 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: fortinet
Published: 2022-12-06T16:00:33.269Z
Updated: 2024-10-23T14:51:54.623Z
Reserved: 2022-07-13T20:38:49.332Z
Link: CVE-2022-35843
Vulnrichment
Updated: 2024-08-03T09:44:22.078Z
NVD
Status : Modified
Published: 2022-12-06T17:15:10.873
Modified: 2024-11-21T07:11:48.250
Link: CVE-2022-35843
Redhat
No data.