CVE-2022-45860

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-1390CWE-287

Affected software

No affected versions have been published.

Timeline

Published
May 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-458616.5An access of uninitialized pointer vulnerability [CWE-824] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.CVE-2022-458628.8An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; ForCVE-2022-458665.3qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversaCVE-2022-458677.2MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achCVE-2022-458687.8The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allowCVE-2022-458695.5A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crCVE-2022-45875.4A vulnerability, which was classified as problematic, has been found in Opencaching Deutschland oc-server3. This issue affects some unknown CVE-2022-458717.5A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash whCVE-2022-458729.8iTerm2 before 3.4.18 mishandles a DECRQSS response.CVE-2022-458735.5systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs iCVE-2022-458745.5Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain filCVE-2022-458759.8Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issu