CVE-2022-45857

published 2023-01-05

CVE-2022-45857: An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a…

Priority P3 39 high 7.5 CVSS 3.1

AV N AC H PR N UI R S C C L I L A H

An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a password via newly created VDOMs after the super_admin account is deleted.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortigate	—	—
fortinet	fortimanager	—	—
fortinet	fortimanager	>= 6.2.0 < 6.2.9	6.2.9
fortinet	fortimanager	6.2.0 – 6.2.8	—
fortinet	fortimanager	>= 6.4.0 < 6.4.8	6.4.8
fortinet	fortimanager	6.4.0 – 6.4.7	—
fortinet	fortimanager	>= 7.0.0 < 7.0.2	7.0.2
fortinet	fortimanager	7.0.0 – 7.0.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-286