{"id":"CVE-2022-40679","state":"PUBLISHED","title":"An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7","description":"An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all versions and FortiDDoS-F 6.4.0, 6.3.0 through 6.3.3, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.","publishedAt":"2023-04-11T16:05:49.688Z","updatedAt":"2024-10-23T14:30:02.463Z","severity":{"score":7.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiDDoS","Fortinet FortiDDoS-F","Fortinet FortiADC"],"affected":[{"vendor":"Fortinet","product":"FortiDDoS","defaultStatus":"unaffected","versions":[{"version":"5.6.0","status":"affected","lessThanOrEqual":"5.6.1","versionType":"semver"},{"version":"5.5.0","status":"affected","lessThanOrEqual":"5.5.1","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.2","versionType":"semver"},{"version":"5.3.0","status":"affected","lessThanOrEqual":"5.3.1","versionType":"semver"},{"version":"5.2.0","status":"affected"},{"version":"5.1.0","status":"affected"},{"version":"5.0.0","status":"affected"},{"version":"4.7.0","status":"affected"},{"version":"4.6.0","status":"affected"},{"version":"4.5.0","status":"affected"},{"version":"4.4.0","status":"affected","lessThanOrEqual":"4.4.2","versionType":"semver"},{"version":"4.3.0","status":"affected","lessThanOrEqual":"4.3.2","versionType":"semver"},{"version":"4.2.1","status":"affected","lessThanOrEqual":"4.2.2","versionType":"semver"},{"version":"4.1.1","status":"affected","lessThanOrEqual":"4.1.12","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThanOrEqual":"4.0.1","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiDDoS-F","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.2","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.4","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiADC","defaultStatus":"unaffected","versions":[{"version":"7.1.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.6","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.4","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.5","versionType":"semver"},{"version":"5.3.0","status":"affected","lessThanOrEqual":"5.3.7","versionType":"semver"},{"version":"5.2.0","status":"affected","lessThanOrEqual":"5.2.8","versionType":"semver"},{"version":"5.1.0","status":"affected","lessThanOrEqual":"5.1.7","versionType":"semver"},{"version":"5.0.0","status":"affected","lessThanOrEqual":"5.0.4","versionType":"semver"}]}],"references":["https://fortiguard.com/psirt/FG-IR-22-335"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T19:50:35.280Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/40xxx/CVE-2022-40679.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-40679","state":"PUBLISHED","datePublished":"2023-04-11T16:05:49.688Z","dateUpdated":"2024-10-23T14:30:02.463Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2022-09-14T13:17:43.617Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all versions and FortiDDoS-F 6.4.0, 6.3.0 through 6.3.3, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands."}],"affected":[{"vendor":"Fortinet","product":"FortiDDoS","defaultStatus":"unaffected","versions":[{"version":"5.6.0","status":"affected","lessThanOrEqual":"5.6.1","versionType":"semver"},{"version":"5.5.0","status":"affected","lessThanOrEqual":"5.5.1","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.2","versionType":"semver"},{"version":"5.3.0","status":"affected","lessThanOrEqual":"5.3.1","versionType":"semver"},{"version":"5.2.0","status":"affected"},{"version":"5.1.0","status":"affected"},{"version":"5.0.0","status":"affected"},{"version":"4.7.0","status":"affected"},{"version":"4.6.0","status":"affected"},{"version":"4.5.0","status":"affected"},{"version":"4.4.0","status":"affected","lessThanOrEqual":"4.4.2","versionType":"semver"},{"version":"4.3.0","status":"affected","lessThanOrEqual":"4.3.2","versionType":"semver"},{"version":"4.2.1","status":"affected","lessThanOrEqual":"4.2.2","versionType":"semver"},{"version":"4.1.1","status":"affected","lessThanOrEqual":"4.1.12","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThanOrEqual":"4.0.1","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiDDoS-F","defaultStatus":"unaffected","versions":[{"version":"6.4.0","status":"affected"},{"version":"6.3.0","status":"affected","lessThanOrEqual":"6.3.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.2","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.4","versionType":"semver"}]},{"vendor":"Fortinet","product":"FortiADC","defaultStatus":"unaffected","versions":[{"version":"7.1.0","status":"affected"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.3","versionType":"semver"},{"version":"6.2.0","status":"affected","lessThanOrEqual":"6.2.4","versionType":"semver"},{"version":"6.1.0","status":"affected","lessThanOrEqual":"6.1.6","versionType":"semver"},{"version":"6.0.0","status":"affected","lessThanOrEqual":"6.0.4","versionType":"semver"},{"version":"5.4.0","status":"affected","lessThanOrEqual":"5.4.5","versionType":"semver"},{"version":"5.3.0","status":"affected","lessThanOrEqual":"5.3.7","versionType":"semver"},{"version":"5.2.0","status":"affected","lessThanOrEqual":"5.2.8","versionType":"semver"},{"version":"5.1.0","status":"affected","lessThanOrEqual":"5.1.7","versionType":"semver"},{"version":"5.0.0","status":"affected","lessThanOrEqual":"5.0.4","versionType":"semver"}]}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-335","name":"https://fortiguard.com/psirt/FG-IR-22-335"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"Execute unauthorized code or commands","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2023-04-11T16:05:49.688Z"},"solutions":[{"lang":"en","value":"Please upgrade to FortiDDoS-F version 6.4.1 or above\r\nPlease upgrade to FortiDDoS-F version 6.3.4 or above\r\nPlease upgrade to FortiDDoS-F version 6.2.3 or above\r\nPlease upgrade to FortiDDoS-F version 6.1.5 or above\n\r\nPlease upgrade to FortiDDoS version 5.7.0 or above\n\r\nPlease upgrade to FortiADC version 7.1.1 or above\r\nPlease upgrade to FortiADC version 7.0.4 or above\r\nPlease upgrade to FortiADC version 6.2.5 or above"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-335","name":"https://fortiguard.com/psirt/FG-IR-22-335","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T12:21:46.383Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-23T14:11:22.289076Z","id":"CVE-2022-40679","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-23T14:30:02.463Z"}}]}}}