CVE-2022-35843 is a critical authentication bypass vulnerability affecting FortiOS (versions 7.2.0, 7.0.0-7.0.7, 6.4.0-6.4.9, and all 6.2/6.0 versions) and FortiProxy (versions 7.0.0-7.0.5, 2.0.0-2.0.10, and all 1.2.0 versions). This flaw allows a remote, unauthenticated attacker to gain full access to affected devices by sending a specially crafted Access-Challenge response from a Radius server. With a CVSS score of 9.8 (Critical), it presents a severe risk of complete compromise (Confidentiality, Integrity, Availability). While not currently listed in CISA's KEV catalog and lacking public exploit code, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.2.0, <= 1.2.13CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 2.0.0, <= 2.0.10CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 7.0.0, <= 7.0.6CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 6.0.0, <= 6.0.15CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | ||
>= 6.2.0, <= 6.2.12CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.