CVE-2022-27491: TCP Middlebox Reflection
A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.
Other sources
An improper verification of source of a communication channel vulnerability [CWE-940] in FortiOS may allow a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim. This is possible only if at least a firewall policy has inspection mode set to flow-based (default), AND at least a Security Profile is enabled (Web Filter, AntiVirus, IPS, DLP, Application Control, SSL, File filter).
— FortiGuard
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-27491?
CVE-2022-27491 is rated as a high severity vulnerability due to the potential for remote and unauthenticated exploitation.
How do I fix CVE-2022-27491?
To mitigate CVE-2022-27491, upgrade Fortinet FortiOS to a version above 7.2.0 or apply the relevant patches provided by Fortinet.
What are the affected versions for CVE-2022-27491?
CVE-2022-27491 affects FortiOS versions from 5.001 to 7.214, with specific exceptions depending on minor versioning.
Who is likely to be targeted by CVE-2022-27491?
CVE-2022-27491 poses a risk to organizations using vulnerable versions of FortiOS, making them targets for remote attackers.
What types of attacks can be executed due to CVE-2022-27491?
Exploitation of CVE-2022-27491 allows attackers to perform action assertions through improperly verified communication channels.