Format string error in FortiOS - CVE-2022-22299
Published: August 2, 2022
Vulnerability identifier: #VU65981
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22299
CWE-ID: CWE-134
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a format string error in the command line interpreter. A remote authenticated user can supply a specially crafted input that contains format string specifiers to the affected CLI command and execute arbitrary code on the target system.
Affected software
FortiOS
FortiProxy
FortiADC
FortiMail
FortiProxy
FortiADC
FortiMail
How to mitigate CVE-2022-22299
Install updates from vendor's website.
FortiOS - addressed in versions 6.0.15, 6.2.11, 6.4.9, 7.0.4
FortiProxy - addressed in versions 2.0.8, 7.0.2
FortiADC - addressed in versions 6.2.3, 7.0.1
FortiMail - addressed in versions 6.4.6, 7.0.3
FortiProxy - addressed in versions 2.0.8, 7.0.2
FortiADC - addressed in versions 6.2.3, 7.0.1
FortiMail - addressed in versions 6.4.6, 7.0.3