Multiple vulnerabilities in FortiOS
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2022-29054 CVE-2022-38378 |
| CWE-ID | CWE-325 CWE-269 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
FortiOS Operating systems & Components / Operating system |
| Vendor | Fortinet, Inc |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Missing cryptographic step
EUVDB-ID: #VU72349
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-29054
CWE-ID:
CWE-325 - Missing Required Cryptographic Step
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to missing cryptographic steps in the functions that encrypt the DHCP and DNS keys (ddns-key or n-mhae-key). A local user in possession of the encrypted key to decipher it.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFortiOS: 6.2.0 - 7.2.0
External linkshttp://fortiguard.fortinet.com/psirt/FG-IR-22-080
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper Privilege Management
EUVDB-ID: #VU72348
Risk: Low
CVSSv3.1: 3.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-38378
CWE-ID:
CWE-269 - Improper Privilege Management
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges on the device.
The vulnerability exists due to improper privilege management. A remote administrative user with access to the admin profile section (System subsection Administrator Users) can modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands.
MitigationInstall updates from vendor's website.
Vulnerable software versionsFortiOS: 6.0.0 - 7.2.0
External linkshttp://fortiguard.com/psirt/FG-IR-22-346
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
