CVE-2022-27491

MEDIUM

FortiOS IPS Engine 4.000-4.085, 5.001-5.258, 6.001-6.121, 7.001-7.113, 7.201-7.214 - DoS via Crafted TCP Requests

Title source: llm
STIX 2.1

Description

A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://fortiguard.com/psirt/FG-IR-22-073

Scores

CVSS v3 6.8
EPSS 0.0006
EPSS Percentile 18.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (2)
fortinet/fortios 7.2.0
fortinet/fortios 6.0.0 - 6.0.14
Published Sep 06, 2022
Tracked Since Feb 18, 2026