PT-2023-1738 · Fortinet · Fortirecorder

Published 2023-03-07 · Updated 2023-04-10 · CVE-2022-41333

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FortiRecorder versions 6.4.3 and below FortiRecorder versions 6.0.11 and below

Description The issue is related to an uncontrolled resource consumption vulnerability. It may allow an unauthenticated attacker to make the device unavailable via crafted GET requests to the login authentication mechanism.

Recommendations For FortiRecorder versions 6.4.3 and below, update to a version above 6.4.3 to resolve the issue. For FortiRecorder versions 6.0.11 and below, update to a version above 6.0.11 to resolve the issue. As a temporary workaround, consider restricting access to the login authentication mechanism to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2023-01329

CVE-2022-41333

Affected Products

Fortirecorder

References · 7

• 🔥 https://exploit-db.com/exploits/51326 · Exploit
• https://fortiguard.com/psirt/FG-IR-22-388 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41333 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01329 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-41333 · Security Note
• http://packetstormsecurity.com/files/171766/FortiRecorder-6.4.3-Denial-Of-Service.html · Note
• https://t.me/cibsecurity/59600 · Telegram Post