Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

saploreal
New Contributor

CVE-2022-42475: Fortinet Patches Zero Day in FortiOS SSL VPNs

Spoiler

 

Hello,

Can this vulnerability CVE-2022-42475 be exploited in conjunction with a 2FA identity mechanism (Certificate)?

5 REPLIES 5
funkylicious
SuperUser
SuperUser

Hi,


As the CVE states, the attacker doesn't need to be authenticated, so to your question to the answer will be yes, it can still be exploited even though you have any kind of 2FA configured.

---------------------------
geek
---------------------------
---------------------------geek---------------------------
saploreal
New Contributor

Thanks for the response, but I'm wondering if it is certain

saploreal
New Contributor

It would be great if Fortinet information security could answer our question ?

jnielsen

Hello. You should upgrade your firewalls if you are running vulnerable versions and have SSLVPN enabled. It doesn't matter if you are using MFA/2FA or not.

JeanHC
New Contributor

Can this vulnerability CVE-2022-42475 be exploited in conjunction with limit access to specific hosts(SSL-VPN Settings>Restrict Access>Limit access to specific hosts)?

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.