CVE-2022-29054 : A missing cryptographic steps vulnerability [CWE-325] in the functions that encr

A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.

Published 2023-02-16 19:15:12

Updated 2023-02-24 23:42:53

Source Fortinet, Inc.

View at NVD, CVE.org

Products affected by CVE-2022-29054

Fortinet » Fortios
Versions from including (>=) 6.2.0 and up to, including, (<=) 6.2.12
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.0.16
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 6.4.0 and up to, including, (<=) 6.4.11
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios
Versions from including (>=) 7.0.0 and before (<) 7.0.8
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortios » Version: 7.2.0
cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy
Versions from including (>=) 1.2.0 and up to, including, (<=) 1.2.13
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy
Versions from including (>=) 2.0.0 and up to, including, (<=) 2.0.11
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy
Versions from including (>=) 7.0.0 and before (<) 7.0.8
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy
Versions from including (>=) 1.1.0 and up to, including, (<=) 1.1.6
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy » Version: 7.2.0
cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortiproxy » Version: 7.2.1
cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-29054

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-29054

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	Fortinet, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2022-29054

https://fortiguard.com/psirt/FG-IR-22-080

PSIRT Advisories | FortiGuard
Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-29054

Products affected by CVE-2022-29054

Exploit prediction scoring system (EPSS) score for CVE-2022-29054

CVSS scores for CVE-2022-29054

References for CVE-2022-29054