CVE-2022-40679

CVE-2022-40679 describes an OS command injection in Fortinet FortiADC (5.x–7.1.0), FortiDDoS (4.x–5.6), and FortiDDoS-F (6.1.0–6.4.0) caused by improper neutralization of special elements in existing commands. An authenticated attacker could execute unauthorized commands via crafted arguments. Ex...

CVE-2022-40679

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all...

Fortinet FortiADC、FortiDDoS和FortiDDoS-F 操作系统命令注入漏洞

Fortinet FortiADC and Fortinet FortiDDoS are both products of Fortinet, Inc. Fortinet FortiADC is an Application Delivery Controller. fortinet FortiDDoS is the only DDoS mitigation platform that can be examined. FortiADC, FortiDDoS, and FortiDDoS-F have a security vulnerability that stems from an...

FortiADC & FortiDDoS & FortiDDoS-F - Command injection in log & report module

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC, FortiDDoS and FortiDDoS-F may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

PT-2022-6547 · Fortinet · Fortiadc +2

Name of the Vulnerable Software and Affected Versions: FortiADC versions 5.x through 7.1.0 FortiDDoS versions 4.x through 5.6 FortiDDoS-F versions 6.1.0 through 6.4.0 Description: The issue is related to an improper neutralization of special elements used in an OS command, which may allow an...

CVE-2022-29060

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

CVE-2022-29060

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

CVE-2022-29060

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

Hardcoded credentials

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

CVE-2022-29060

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

CVE-2022-29060

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

CVE-2022-29060

Fortinet's FortiDDoS API is affected by a hard-coded cryptographic key vulnerability (CWE-321) across FortiDDoS API versions 5.1.0–5.5.1. An attacker who can retrieve the key from one device can sign JWT tokens for any device, enabling unauthorized access. The issue is documented in Fortinet PSIR...

The vulnerability of the FortiDDoS software-defined security device, which stems from the use of a strictly encrypted cryptographic key, allows attackers to sign JWT tokens for various devices.

The vulnerability of the FortiDDoS software protection system against DDoS attacks is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability allows a malicious actor to sign JWT tokens for various devices remotely...

FortiDDoS - Use of hardcoded key for the JWT token

A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...

Fortinet FortiDDoS 信任管理问题漏洞

Fortinet FortiDDoS is the only checkable DDoS mitigation platform from Fortinet USA. Fortinet FortiDDoS has a security vulnerability that stems from the use of hard-coded encryption keys. A remote attacker exploits the vulnerability to sign JWT tokens for other devices...

PT-2022-7656 · Fortinet · Fortiddos-F +1

Name of the Vulnerable Software and Affected Versions: FortiDDoS versions 4.5.0 through 5.5.1 FortiDDoS-F versions 6.1.0 through 6.3.1 Description: The issue is related to an improper neutralization of special elements used in an operating system command, also known as 'os command injection', in...

Multiple Products - Retrieval of sensitive information in cleartext via GUI

A cleartext storage of sensitive information in the GUI of FortiADC, FortiSIEM, FortiDDoS, FortiDDoS-CM and FortiDDoS-F may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords, RADIUS shared secret and the Elastic Cloud database password by...

FortiDDoS Command Injection Vulnerability Announcement

A vulnerability in FortiDDoS allows escalation of privilege via remote OS injection through crafted URLs sent to the GUI. The user is required to be logged in for an exploit to work...