CVE-2022-29054

Published: Feb 16, 2023Modified: Jun 17, 2026

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.

Affected (11)

Products: Fortinet: Fortios, Fortiproxy

Fortinet

2 products

Fortios

Fortiproxy

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	From 6.0.0 to 6.0.16
Fortinet Fortios	From 6.2.0 to 6.2.12
Fortinet Fortios	From 6.4.0 to 6.4.11
Fortinet Fortios	From 7.0.0 to 7.0.8
Fortinet Fortios	Version 7.2.0
Fortinet Fortiproxy	From 1.1.0 to 1.1.6
Fortinet Fortiproxy	From 1.2.0 to 1.2.13
Fortinet Fortiproxy	From 2.0.0 to 2.0.11
Fortinet Fortiproxy	From 7.0.0 to 7.0.8
Fortinet Fortiproxy	Version 7.2.0
Fortinet Fortiproxy	Version 7.2.1

Related CWEs

CWE-329

Generation of Predictable IV with CBC Mode

The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

References (2)

https://fortiguard.com/psirt/FG-IR-22-080

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-080

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.