An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://fortiguard.com/psirt/FG-IR-22-255 |
History
No history.
MITRE
Status: PUBLISHED
Assigner: fortinet
Published: 2022-12-06T16:00:33.269Z
Updated: 2024-08-03T09:44:22.078Z
Reserved: 2022-07-13T20:38:49.332Z
Link: CVE-2022-35843
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-12-06T17:15:10.873
Modified: 2023-11-07T03:49:25.277
Link: CVE-2022-35843
Redhat
No data.