How severe is CVE-2022-29054?

CVE-2022-29054 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2022-29054 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-29054?

CVE-2022-29054 primarily affects Fortinet Fortiproxy. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-29054?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2022-29054 published?

CVE-2022-29054 was published on 2023-02-16 and last updated on 2026-06-17.

CVE-2022-29054

CVE-2022-29054 is a low-severity vulnerability in Fortinet Fortiproxy with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-329.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-329
Affected product: Fortinet Fortiproxy
Published: 2023-02-16
Last modified: 2026-06-17

Description

A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.

Frequently asked questions

What is CVE-2022-29054?: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it.
How severe is CVE-2022-29054?: CVE-2022-29054 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2022-29054 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-29054?: CVE-2022-29054 primarily affects Fortinet Fortiproxy. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-29054?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2022-29054 published?: CVE-2022-29054 was published on 2023-02-16 and last updated on 2026-06-17.

References

https://fortiguard.com/psirt/FG-IR-22-080

Affected products (5)

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*

More vulnerabilities in Fortinet Fortiproxy

CVE-2026-24858 — Critical (CVSS 9.8): An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet…
CVE-2025-59718 — Critical (CVSS 9.8): A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0…
CVE-2025-22252 — Critical (CVSS 9.8): A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager…
CVE-2023-25610 — Critical (CVSS 9.8): A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version…
CVE-2024-55591 — Critical (CVSS 9.8): An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0…
CVE-2023-42789 — Critical (CVSS 9.8): A out-of-bounds write in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through…

All CVEs affecting Fortinet Fortiproxy →

Other CWE-329 vulnerabilities

CVE-2022-46397 — High (CVSS 7.5): FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09, 20.05, 20.01, 19.08, and 19.04…
CVE-2024-49783 — Medium (CVSS 5.3): IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If…
CVE-2024-56141 — Medium (CVSS 5.0): Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit…
CVE-2026-14969 — Medium (CVSS 4.4): A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization…
CVE-2025-2814 — Medium (CVSS 4.0): Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which…

Browse all CWE-329 vulnerabilities →