Fortitester
CVE-2022-35846
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack.
AnalysisAI
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-307. An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack. Affected products include: Fortinet Fortitester. Version information: through 3.9.1.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Fortitester
View allAn improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] i
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] i
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] i
An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticat
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpre
A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who man
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpre
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface
A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 throu
A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an att
An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today