« Back to list

CVE-2022-26115

Status: ModifiedHigh (7.5)—

A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Fortinet — Fortisandbox

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-26115",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-26115",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-22T20:18:30.750261Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "vendor": "Fortinet",
          "product": "FortiSandbox",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "4.0.2"
            },
            {
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "3.2.3"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-02-16T19:15:12.047",
  "references": [
    {
      "url": "https://fortiguard.com/psirt/FG-IR-20-220",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "url": "https://fortiguard.com/psirt/FG-IR-20-220",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-916"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-916"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords."
    }
  ],
  "lastModified": "2026-06-17T04:34:42.753",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DDB3490-E30F-45CC-81B7-EFB5C1A60DA7"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "143DD85B-4CE7-409D-B215-6069D2EF33D0"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53070F6A-CC5B-43C9-96F9-2C0930A8D3CE"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B38F72A-A271-43FE-8FBF-02AB87BA9D47"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0260B512-77CA-4FE8-A039-D7B287A19BAA"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D6CCD1A-3412-4A55-88A8-40B227FB00BA"
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51A80522-EBFC-4C3E-BF38-01453CC359F7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}