CVE-2022-23441 is a critical vulnerability affecting FortiEDR versions 5.0.2 and earlier, stemming from the use of a hard-coded cryptographic key. This flaw allows an unauthenticated network attacker to impersonate FortiEDR collectors and forge messages, leading to a high impact on confidentiality and integrity. With a CVSS score of 9.1, it is easily exploitable over the network with low attack complexity. While no public exploits, Metasploit modules, or significant community discussion are currently observed, the potential for severe compromise necessitates immediate patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.0.0CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiedr:4.0.0:*:*:*:*:*:*:* | ||
5.0.0CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiedr:5.0.0:*:*:*:*:*:*:* | ||
5.0.1CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiedr:5.0.1:*:*:*:*:*:*:* | ||
5.0.2CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiedr:5.0.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.