CVE-2022-41328
Fortinet FortiOS Path Traversal Vulnerability
Description
CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS that allows a privileged attacker to read and write arbitrary files on the underlying Linux system through crafted CLI commands. This vulnerability affects FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, and versions before 6.4.11. Despite requiring high privileges for exploitation, CVE-2022-41328 has been actively exploited in the wild, with CISA adding it to the Known Exploited Vulnerabilities catalog. The vulnerability carries a CVSS score of 6.7 (Medium) and an EPSS score of 0.24%, but its confirmed use in targeted attacks against government and critical infrastructure organizations underscores its significance.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | >= 6.0.0, <= 6.0.16; >= 6.2.0, < 6.2.14; >= 6.4.0, < 6.4.12; >= 7.0.0, < 7.0.10; >= 7.2.0, < 7.2.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://fortiguard.com/psirt/FG-IR-22-369(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41328(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Fortinet FortiOS does not properly sanitize file path inputs in certain CLI commands, allowing an authenticated attacker with elevated privileges to traverse directory boundaries and access files outside the intended restricted directory. This path traversal weakness enables reading and writing to arbitrary locations on the underlying Linux filesystem, bypassing FortiOS's intended file access restrictions.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2022-41328 enables a privileged attacker to compromise the integrity of Fortinet FortiOS appliances by reading and writing arbitrary files on the underlying operating system. Attack Vector (Local): The vulnerability requires local access to the FortiOS CLI, meaning the attacker must already have an authenticated session on the device. Attack Complexity (Low): Once CLI access is obtained, the exploitation technique is straightforward with no complex prerequisites. Privileges Required (High): The attacker needs elevated administrative privileges on the FortiOS device to execute the crafted CLI commands. User Interaction (None): No additional user action is needed beyond the attacker's own commands. Confidentiality, Integrity, and Availability (all High): Successful exploitation grants the attacker full read and write access to the underlying Linux filesystem, enabling data exfiltration, configuration tampering, firmware modification, and potential persistent backdoor installation. While the CVSS score of 6.7 reflects the high privilege requirement, the confirmed active exploitation by sophisticated threat actors against government organizations demonstrates that attackers are able to chain this with other vulnerabilities or use compromised credentials to meet the privilege prerequisite.
Exploit Maturity
CVE-2022-41328 has been actively exploited in the wild by sophisticated threat actors, as confirmed by CISA's inclusion in the Known Exploited Vulnerabilities catalog with a remediation deadline of April 4, 2023. The exploitation has been attributed to advanced persistent threat groups targeting government entities and large organizations, where attackers used the path traversal to modify FortiOS firmware and install persistent backdoors. The EPSS score of 0.24% at the 46.31st percentile is relatively low, suggesting that while exploitation is targeted rather than widespread, the attacks that do occur are highly impactful and conducted by well-resourced threat actors. The combination of KEV listing with low EPSS indicates focused, strategic exploitation rather than broad opportunistic attacks.
Remediation
- Upgrade FortiOS to patched versions immediately — Update FortiOS 7.2.x to version 7.2.4 or later, FortiOS 7.0.x to version 7.0.10 or later, and FortiOS 6.4.x to version 6.4.12 or later, as detailed in the FortiGuard advisory FG-IR-22-369. Per CISA's directive, apply mitigations or discontinue use if patches are unavailable.
- Verify firmware integrity — After patching, validate the integrity of FortiOS firmware and system files. Compare file checksums against known-good baselines provided by Fortinet to detect potential tampering from prior exploitation.
- Restrict and audit CLI access — Limit FortiOS CLI access to only essential administrators using role-based access controls. Enable comprehensive audit logging for all CLI sessions and review logs for suspicious commands, particularly those involving file operations or path manipulation.
- Monitor for indicators of compromise — Check for unexpected files or modifications on the FortiOS filesystem, unauthorized firmware changes, or anomalous network traffic from FortiGate devices. Review FortiOS event logs for evidence of path traversal attempts in CLI command history.
- Implement network segmentation for management interfaces — Ensure FortiOS management interfaces (CLI, web GUI) are only accessible from dedicated out-of-band management networks. Deploy multi-factor authentication for all administrative access to prevent credential-based attacks that could provide the elevated privileges needed for exploitation.
Technical Details
CVE-2022-41328 is a path traversal vulnerability (CWE-22) in Fortinet FortiOS's command-line interface that fails to properly restrict file path inputs to authorized directories. An authenticated attacker with administrative privileges can craft CLI commands containing directory traversal sequences (such as "../") to escape the intended file access boundaries and read or write files anywhere on the underlying Linux operating system. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that while the attack requires local access and high privileges, successful exploitation results in complete compromise of confidentiality, integrity, and availability of the FortiOS device. In observed attacks, threat actors exploited this vulnerability to modify the device firmware at the filesystem level, implanting persistent backdoors that survived reboots and firmware updates, and to exfiltrate sensitive configuration data including VPN credentials and routing tables.
Frequently Asked Questions
Is CVE-2022-41328 being actively exploited?
Yes, CVE-2022-41328 has been actively exploited in the wild by advanced threat actors targeting government organizations and critical infrastructure. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 4, 2023. The attacks involved modifying FortiOS firmware to install persistent backdoors.
What products are affected by CVE-2022-41328?
CVE-2022-41328 affects Fortinet FortiOS versions 7.2.0 through 7.2.3, versions 7.0.0 through 7.0.9, and all versions before 6.4.11. Any FortiGate device or Fortinet appliance running these FortiOS versions is potentially vulnerable.
How do I fix CVE-2022-41328?
Upgrade FortiOS to version 7.2.4 or later (for 7.2.x branch), 7.0.10 or later (for 7.0.x branch), or 6.4.12 or later (for 6.4.x branch). After patching, verify firmware integrity by comparing checksums against known-good baselines from Fortinet. See the Remediation section for comprehensive steps.
How severe is CVE-2022-41328?
CVE-2022-41328 is rated Medium severity with a CVSS score of 6.7. While the score reflects the requirement for high privileges and local access, the confirmed active exploitation by sophisticated threat actors and the potential for persistent firmware-level compromise make this a high-priority remediation target for organizations running affected FortiOS versions.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.