CVE-2022-30305: Fortinet Fortideceptor

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2 may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts.

Affected products

• Fortinet Fortideceptor: from 3.0.0, up to and including 3.0.2; from 3.2.0, up to and including 3.2.2; from 3.3.0, up to and including 3.3.3; from 4.0.0, up to and including 4.0.2; version 3.1.0 only; version 3.1.1 only; …
• Fortinet FortiSandbox: from 3.1.0, up to and including 3.1.5; from 4.0.0, up to and including 4.0.2; version 3.2.0 only; version 3.2.1 only; version 3.2.2 only; version 3.2.3 only

Published 2022-12-06. Last modified 2026-06-17.