High severity · published Mar 7, 2023
CVE-2022-41333
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated…
7.5
CVSS
7.2%
EPSS
No
On KEV
Description
An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.2% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fortirecorder Firmware · Fortinet
6.0.0 through 6.0.11; 6.4.0 through 6.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41333
packetstormsecurity.com
http://packetstormsecurity.com/files/171766/FortiRecorder-6.4.3-Denial-Of-Service.html
Vendor Advisory
https://fortiguard.com/psirt/FG-IR-22-388
More from Fortirecorder Firmware
9.8
CVE-2019-6698
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and…
6.7
CVE-2021-42757
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code…
5.5
CVE-2022-22297
An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb…
4.3
CVE-2021-42755
An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS…