CVE-2022-22299: High severity fortinet fortiadc vulnerability

Q: What is the severity of CVE-2022-22299?

CVE-2022-22299 has a critical severity rating due to the potential for remote code execution.

Q: How do I fix CVE-2022-22299?

To fix CVE-2022-22299, upgrade to FortiADC versions 6.0.5 or later, 6.1.6 or later, 6.2.2 or later, or the latest versions of FortiProxy and FortiMail.

Q: What software is affected by CVE-2022-22299?

CVE-2022-22299 affects multiple versions of FortiADC, FortiProxy, and FortiMail software.

Q: What types of attacks can exploit CVE-2022-22299?

CVE-2022-22299 can be exploited through format string vulnerabilities, which can lead to unauthorized access or system crashes.

Q: Is there a workaround for CVE-2022-22299?

Currently, the only reliable workaround for CVE-2022-22299 is to apply the appropriate updates to the affected software.

Published Aug 5, 2022

Updated

A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments.

Affected Software

20 affected components

Fortinet FortiADC>=6.0.0<=6.0.4

Fortinet FortiADC>=6.1.0<=6.1.6

Fortinet FortiADC=6.2.0

Fortinet FortiADC=6.2.1

Fortinet FortiMail>=6.4.0<=6.4.5

Fortinet FortiMail>=7.0.0<=7.0.2

Fortinet FortiProxy>=1.0.0<=1.0.7

Fortinet FortiProxy>=1.1.0<=1.1.6

Fortinet FortiProxy>=1.2.0<=1.2.13

Fortinet FortiProxy>=2.0.0<=2.0.7

Fortinet FortiProxy=7.0.0

Fortinet FortiProxy=7.0.1

Fortinet FortiOS>=5.0.0<=5.0.14

Fortinet FortiOS>=5.2.0<=5.2.15

Fortinet FortiOS>=5.4.0<=5.4.13

Fortinet FortiOS>=5.6.0<=5.6.14

Fortinet FortiOS>=6.0.0<=6.0.14

Fortinet FortiOS>=6.2.0<=6.2.10

Fortinet FortiOS>=6.4.0<6.4.8

Fortinet FortiOS>=7.0.0<7.0.2

Remediation

Patch Available

https://fortiguard.com/psirt/FG-IR-21-235

Event History

Aug 5, 2022

CVE Published

via MITRE·03:23 PM

Data Sourced

via MITRE·03:23 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-22299?

CVE-2022-22299 has a critical severity rating due to the potential for remote code execution.

How do I fix CVE-2022-22299?

To fix CVE-2022-22299, upgrade to FortiADC versions 6.0.5 or later, 6.1.6 or later, 6.2.2 or later, or the latest versions of FortiProxy and FortiMail.

What software is affected by CVE-2022-22299?