CVE-2022-40675

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
Fortinet	FortiNAC	>= 9.4.0, <= 9.4.1; >= 9.2.0, <= 9.2.7; >= 9.1.0, <= 9.1.8; >= 8.8.0, <= 8.8.11; >= 8.7.0, <= 8.7.6; >= 8.6.0, <= 8.6.5; >= 8.5.0, <= 8.5.4; 8.3.7

References

https://fortiguard.com/psirt/FG-IR-22-312Vendor Advisory
https://fortiguard.com/psirt/FG-IR-22-312Vendor Advisory

Timeline

Published: Feb 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-406765.4A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.CVE-2022-406778.8A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.CVE-2022-406787.8An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11,CVE-2022-406797.8An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, CVE-2022-40685.4A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username CVE-2022-406805.4A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6 CVE-2022-406817.1A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacke CVE-2022-406827.8A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacke CVE-2022-406837.8A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially cr CVE-2022-406849.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.CVE-2022-406856.5Insufficiently protected credentials in the Intel(R) DCM software before version 5.0.1 may allow an authenticated user to potentially enable CVE-2022-406868.8Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.