CVE-2022-40684

CVE-2022-40684 is a critical-severity (CVSS 9.8) vulnerability in Fortinet Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalog on October 11, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 1, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html
• http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
• https://fortiguard.com/psirt/FG-IR-22-377
• http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html
• http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
• https://fortiguard.com/psirt/FG-IR-22-377
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684