Fortinet PSIRT Monthly Advisories — October 2022

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

• Critical 9.8
  CVE-2022-33872 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in Telnet login components of FortiTeste…
  EPSS 3%
• Critical 9.8
  CVE-2022-33874 An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester 2…
  EPSS 3%
• Critical 9.0
  CVE-2021-44171 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version …
  EPSS 1.5%

All vulnerabilities 8