CVE-2022-35846 : An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 th

An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack.

Published 2022-10-18 14:15:10

Updated 2022-10-20 19:03:57

Source Fortinet, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-35846

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 58 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-35846

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	Fortinet, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-35846

CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2022-35846

Fortinet » Fortitester
Versions from including (>=) 2.3.0 and before (<) 3.9.2
cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortitester
Versions from including (>=) 7.0.0 and before (<) 7.1.1
cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*
Matching versions
Fortinet » Fortitester
Versions from including (>=) 4.0.0 and before (<) 4.2.1
cpe:2.3:a:fortinet:fortitester:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-35846

Exploit prediction scoring system (EPSS) score for CVE-2022-35846

CVSS scores for CVE-2022-35846

CWE ids for CVE-2022-35846

References for CVE-2022-35846

Products affected by CVE-2022-35846