CVE-2022-35849
Last modified
CVE-2022-35849 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortiadc | < 6.2.6 |
| Fortinet | Fortiadc | >= 7.0.0, < 7.0.4 |
| Fortinet | Fortiadc | >= 7.1.0, < 7.1.2 |
References
- https://fortiguard.com/psirt/FG-IR-22-310Vendor Advisory
- https://fortiguard.com/psirt/FG-IR-22-310Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-35849?
How severe is CVE-2022-35849?
How do I fix CVE-2022-35849?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-35842An exposure of sensitive information to an unauthorized acto…7.5
- CVE-2022-35843An authentication bypass by assumed-immutable data vulnerabi…9.8
- CVE-2022-35844An improper neutralization of special elements used in an OS…7.2
- CVE-2022-35845Multiple improper neutralization of special elements used in…8.8
- CVE-2022-35846An improper restriction of excessive authentication attempts…9.8
- CVE-2022-35847An improper neutralization of special elements used in a tem…8.8
- CVE-2022-3585A vulnerability classified as problematic has been found in …4.3
- CVE-2022-35850An improper neutralization of script-related HTML tags in a …6.1
- CVE-2022-35851An improper neutralization of input during web page generati…5.4
- CVE-2022-35857kvf-admin through 2022-02-12 allows remote attackers to exec…9.8
- CVE-2022-35858The TEE_PopulateTransientObject and __utee_from_attr functio…7.8
- CVE-2022-3586A flaw was found in the Linux kernel’s networking code. A us…5.5
Are you affected by CVE-2022-35849?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST