CVE-2022-40684
Fortinet Multiple Products Authentication Bypass Vulnerability
Description
CVE-2022-40684 is a critical authentication bypass vulnerability affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager that allows an unauthenticated remote attacker to perform administrative operations via specially crafted HTTP or HTTPS requests. The vulnerability enables complete takeover of affected Fortinet devices without any credentials. With an EPSS score of 94.40% (99.98th percentile), CVE-2022-40684 is among the most actively exploited vulnerabilities. CISA added it to the KEV catalog on October 11, 2022, and it has been confirmed as being used in ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 7.0.0, < 7.0.7; 7.2.0 |
| fortinet | fortiswitchmanager | 7.0.0; 7.2.0 |
| fortinet | fortios | >= 7.0.0, < 7.0.7; >= 7.2.0, < 7.2.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html(Exploit, Third Party Advisory, VDB Entry)
- https://fortiguard.com/psirt/FG-IR-22-377(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40684(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2022-40684 exploits an authentication bypass weakness in Fortinet's administrative interface. The product fails to properly validate authentication credentials for certain HTTP/HTTPS request patterns, allowing unauthenticated attackers to access administrative functionality that should require valid credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2022-40684 is a critical severity authentication bypass that is remotely exploitable without authentication, user interaction, or any special conditions. An attacker can gain full administrative access to Fortinet FortiOS, FortiProxy, and FortiSwitchManager devices, enabling them to modify firewall rules, intercept network traffic, create VPN accounts, and pivot deeper into corporate networks. Confidentiality, integrity, and availability are critically impacted: the attacker gains complete control over the network security appliance, can exfiltrate sensitive configuration data including VPN credentials, and can disable security protections entirely. The confirmed use in ransomware campaigns and the EPSS score of 94.40% make this vulnerability an urgent priority for all affected organizations.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2022-40684 and added it to the KEV catalog on October 11, 2022, with a remediation deadline of November 1, 2022. The vulnerability has been confirmed as used in ransomware campaigns, making it a critical threat to organizational security. The EPSS score of 94.40% (99.98th percentile) indicates near-certain exploitation activity. Public exploit code is widely available, and the vulnerability has been actively targeted by multiple threat groups to compromise enterprise network perimeters.
Remediation
- Apply Fortinet patches immediately: Update FortiOS to version 7.2.2, 7.0.7, or later; FortiProxy to version 7.2.1, 7.0.7, or later; and FortiSwitchManager to version 7.2.1 or later.
- Disable HTTP/HTTPS administrative access: If immediate patching is not feasible, disable HTTP/HTTPS administrative interface access from the internet as a temporary mitigation.
- Restrict administrative access by IP: Configure local-in policies to limit access to the administrative interface from trusted management IP addresses only.
- Check for indicators of compromise: Review administrative user accounts for unauthorized additions, inspect configuration changes for unexpected modifications to firewall policies or VPN settings, and search logs for suspicious HTTP requests targeting the administrative interface.
- Rotate all credentials: After patching, rotate all administrative passwords and any VPN user credentials that may have been compromised through the authentication bypass.
Technical Details
CVE-2022-40684 is an authentication bypass vulnerability in the administrative interfaces of Fortinet FortiOS, FortiProxy, and FortiSwitchManager. The flaw allows an unauthenticated attacker to craft specific HTTP or HTTPS requests that bypass the authentication mechanism entirely, granting access to administrative API endpoints. The vulnerability exists in the request forwarding logic where a specially constructed Forwarded HTTP header can trick the system into treating an external request as if it originated from a trusted internal management interface. By setting the Forwarded header to reference a trusted IP address, the attacker can impersonate an authenticated administrator and perform any administrative operation, including adding SSH keys, modifying configurations, and creating new admin accounts. The trivial exploitation complexity combined with the network-facing nature of affected products makes this vulnerability extremely dangerous.
Frequently Asked Questions
Is CVE-2022-40684 being actively exploited?
Yes, CVE-2022-40684 is being actively exploited and has been confirmed as used in ransomware campaigns. CISA added it to the KEV catalog on October 11, 2022. The EPSS score of 94.40% indicates near-certain exploitation activity.
What products are affected by CVE-2022-40684?
CVE-2022-40684 affects Fortinet FortiOS versions 7.0.0 through 7.0.6 and 7.2.0 through 7.2.1, FortiProxy versions 7.0.0 through 7.0.6 and 7.2.0, and FortiSwitchManager versions 7.0.0 and 7.2.0.
How do I fix CVE-2022-40684?
Update FortiOS, FortiProxy, and FortiSwitchManager to the latest patched versions. As an immediate workaround, disable HTTP/HTTPS administrative access from the internet and restrict access to trusted IPs only. See the Remediation section for details.
How severe is CVE-2022-40684?
CVE-2022-40684 is a critical severity vulnerability with an EPSS score of 94.40% (99.98th percentile) and confirmed ransomware usage. It allows unauthenticated attackers to gain full administrative control over Fortinet security appliances.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.