CVE-2022-27491: fortinet fortinet fortios
Vulnerability summary
CVE-2022-27491 is a high (CVSS 7.5) vulnerability in fortinet fortinet fortios. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 72% of scored vulnerabilities.
Timeline
- 06-09-2022PublishedVulnerability first disclosed.
- 22-10-2024Last modifiedVulnerability information updated.
Description
A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:F/RL:U/RC:CDiffers
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.39% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Fortinet2 products
- fortinet fortiosFortiOS 7.2.0, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0, 6.4.9, 6.4.8, 6.4.7, 6.4.6, 6.4.5, 6.4.4, 6.4.3, 6.4.2, 6.4.1, 6.4.0, 6.2.10, 6.2.9, 6.2.8, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.14, 6.0.13, 6.0.12, 6.0.11, 6.0.10, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
- fortiosEOL≥ 6.0.0, ≤ 6.0.14 | ≥ 6.2.0, < 6.2.11 | ≥ 6.4.0, < 6.4.9 | ≥ 7.0.0, < 7.0.6 | 7.2.0
1 vendor · 2 products