PT-2022-4986 · Fortinet · Fortios+2

Published 2022-10-07 · Updated 2026-05-16 · CVE-2022-40684

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.0.0 through 7.2.1 Fortinet FortiProxy versions 7.0.0 through 7.2.0 Fortinet FortiSwitchManager versions 7.0.0 and 7.2.0

Description An authentication bypass vulnerability exists in Fortinet FortiOS, FortiProxy, and FortiSwitchManager. This flaw allows an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. Exploitation of this issue has been observed, with reports of attackers downloading configuration files and adding malicious administrator accounts. Approximately 160,000 devices are estimated to be potentially vulnerable. Recent data breaches have exposed sensitive information, including usernames, passwords, device management certificates, and firewall rules, from over 15,000 FortiGate devices. The vulnerability allows attackers to bypass authentication and potentially gain full administrative access. The Local Process Access indicator in device logs can signal exploitation attempts. The vulnerability can be exploited via the /api/v1/login endpoint, potentially manipulating the username, profname, vdom, and loginname variables.

Recommendations FortiOS versions 7.0.0 through 7.2.1: Disable the HTTP/HTTPS administrative interface or limit IP addresses that can reach the administrative interface. FortiProxy versions 7.0.0 through 7.2.0: Disable the HTTP/HTTPS administrative interface or, for FortiProxy VM all versions and FortiProxy appliance 7.0.6, limit IP addresses that can reach the administrative interface. FortiSwitchManager versions 7.0.0 and 7.2.0: Disable the HTTP/HTTPS administrative interface.

Exploit

Fix

Improper Authentication

Improper Authorization

Weakness Enumeration

CWE-287

CWE-285

Related Identifiers

BDU:2022-06189

CVE-2022-40684

FORTIOSWEBADMIN_CVE_2022_40684

Affected Products

Fortios

Fortiproxy

Fortiswitchmanager

References · 148

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb · Exploit
• 🔥 https://github.com/horizon3ai/CVE-2022-40684 · Exploit
• 🔥 https://github.com/carlosevieira/CVE-2022-40684 · Exploit
• 🔥 https://github.com/arsolutioner/fortigate-belsen-leak · Exploit
• 🔥 https://github.com/Filiplain/Fortinet-PoC-Auth-Bypass · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2022-40684-POC · Exploit
• 🔥 https://github.com/TaroballzChen/CVE-2022-40684-metasploit-scanner · Exploit
• 🔥 https://github.com/hughink/CVE-2022-40684 · Exploit
• 🔥 https://github.com/qingsiweisan/CVE-2022-40684 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2022-40684 · Exploit
• 🔥 https://github.com/secunnix/CVE-2022-40684 · Exploit
• 🔥 https://github.com/mohamedbenchikh/CVE-2022-40684 · Exploit
• 🔥 https://github.com/z-bool/CVE-2022-40684 · Exploit
• 🔥 https://github.com/und3sc0n0c1d0/CVE-2022-40684 · Exploit
• 🔥 https://github.com/Grapphy/fortipwn · Exploit