CVE-2022-22302

3.3 lowEPSS 0.3%

Low (3.3) in fortinet. EPSS 0.3% chance of exploitation in the next 30 days.

A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via accessing the files on the filesystem.

Severity

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-312
Published: 2023-07-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortiauthenticator
fortinet:fortios

References

https://fortiguard.com/psirt/FG-IR-20-014
https://fortiguard.com/psirt/FG-IR-20-014

Check your stack JSON