PT-2022-4986 · Fortinet · Fortiswitchmanager+2

CVE-2022-40684 · Published 2022-10-07 · Updated 2026-08-06

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.0.0 through 7.0.6 FortiOS versions 7.2.0 through 7.2.1 FortiProxy version 7.0.0 through 7.0.6 FortiProxy version 7.2.0 FortiSwitchManager version 7.0.0 FortiSwitchManager version 7.2.0

Description An authentication bypass using an alternate path or channel in Fortinet products allows an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. The estimated number of potentially affected devices worldwide is around 15,000. This issue has been exploited in real-world incidents, with attackers downloading configuration files and adding malicious super admin accounts. Technical details include the use of specially crafted HTTP or HTTPS requests to exploit the vulnerability. The user="Local Process Access" indicator in device logs may signify a compromise.

Recommendations FortiOS versions 7.0.0 through 7.0.6: Disable HTTP/HTTPS administrative interface or limit IP addresses that can reach the administrative interface. FortiOS versions 7.2.0 through 7.2.1: Disable HTTP/HTTPS administrative interface or limit IP addresses that can reach the administrative interface. FortiProxy version 7.0.0 through 7.0.6: Disable HTTP/HTTPS administrative interface or limit IP addresses that can reach the administrative interface for versions 7.0.6. FortiProxy version 7.2.0: Disable HTTP/HTTPS administrative interface. FortiSwitchManager version 7.0.0: Disable HTTP/HTTPS administrative interface. FortiSwitchManager version 7.2.0: Disable HTTP/HTTPS administrative interface.

Exploit

Fix

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-285

CWE-287

Related Identifiers

BDU:2022-06189

CVE-2022-40684

FORTIOSWEBADMIN_CVE_2022_40684

Affected Products

Fortios

Fortiproxy

Fortiswitchmanager

References · 156

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authentication_bypass_cve_2022_40684.rb · Exploit
• 🔥 https://github.com/horizon3ai/CVE-2022-40684 · Exploit
• 🔥 https://github.com/carlosevieira/CVE-2022-40684 · Exploit
• 🔥 https://github.com/arsolutioner/fortigate-belsen-leak · Exploit
• 🔥 https://github.com/Filiplain/Fortinet-PoC-Auth-Bypass · Exploit
• 🔥 https://github.com/kljunowsky/CVE-2022-40684-POC · Exploit
• 🔥 https://github.com/TaroballzChen/CVE-2022-40684-metasploit-scanner · Exploit
• 🔥 https://github.com/hughink/CVE-2022-40684 · Exploit
• 🔥 https://github.com/qingsiweisan/CVE-2022-40684 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2022-40684 · Exploit
• 🔥 https://github.com/secunnix/CVE-2022-40684 · Exploit
• 🔥 https://github.com/z-bool/CVE-2022-40684 · Exploit
• 🔥 https://github.com/mohamedbenchikh/CVE-2022-40684 · Exploit
• 🔥 https://github.com/und3sc0n0c1d0/CVE-2022-40684 · Exploit
• 🔥 https://github.com/Grapphy/fortipwn · Exploit