CVE-2022-23440

CWE-798 — Hard-coded Credentials5 documents5 sources
Severity
7.8HIGH
EPSS
0.0%
top 86.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet Fortinet FortiedrFortinet Fortiedr
Timeline
PublishedApr 6
Latest updateApr 7

Description

A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDfortinet/fortiedr4 versions+3
▶CVEListV5fortinet/fortinet_fortiedrFortiEDR 5.0.2, 5.0.1, 5.0.0, 4.0.0

Patches

Patch: fortiguard.com ↗Patch: fortiguard.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-5p2j-jqf9-mg2f: A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5↗2022-04-07
▶
CVEList
CVE-2022-23440: A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5↗2022-04-06
▶

📋Vendor Advisories

2
Fortinet
A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versi...↗2022-04-06
▶
Oracle
Oracle Oracle Communications Risk Matrix: Policy (set-value) — CVE-2021-23440↗2022-01-15
▶
CVE-2022-23440 (HIGH CVSS 7.8) | A use of hard-coded cryptographic k | cvebase.io