CVE-2022-33874

9.8 criticalEPSS 3.0%

Critical (9.8) in fortinet fortitester. EPSS 3.0% chance of exploitation in the next 30 days.

An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in SSH login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

fortinet:fortitester

References

https://fortiguard.com/psirt/FG-IR-22-237
https://fortiguard.com/psirt/FG-IR-22-237

Check your stack JSON