Authentication bypass using an alternate path or channel in FortiOS and FortiProxy - CVE-2022-40684
Published: October 8, 2022 / Updated: October 25, 2024
Vulnerability identifier: #VU68070
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-40684
CWE-ID: CWE-288
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected device.
The vulnerability exists due to missing authentication within the administrative web interface. A remote non-authenticated attacker can bypass authentication and compromise the affected device.
Affected software
FortiOS
FortiProxy
FortiSwitch Manager
FortiProxy
FortiSwitch Manager
How to mitigate CVE-2022-40684
Install updates from vendor's website.
FortiOS - addressed in versions 7.0.7, 7.2.2
FortiProxy - addressed in versions 7.0.7, 7.2.1
FortiSwitch Manager - update to 7.2.1
FortiProxy - addressed in versions 7.0.7, 7.2.1
FortiSwitch Manager - update to 7.2.1
Links to Public Exploits and PoC-codes
- Exploit #10713 - FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass (October 25, 2024)
- Exploit #8871 - CVE-2022-40684 (一键枚举所有用户名以及写入SSH公钥) (February 28, 2023)
- Exploit #8546 - gotigate (Exploit Fortigate - CVE-2022-40684) (October 29, 2022)
- Exploit #8545 - CVE-2022-40684-metasploit-scanner (An authentication bypass using an alternate path or channel in Fortinet product) (October 29, 2022)
- Exploit #8542 - CVE-2022-40684 () (October 26, 2022)
- Exploit #8532 - fortipwn (Forti CVE-2022-40684 enumeration script built in Rust) (October 25, 2022)
- Exploit #8507 - CVE-2022-40684 (Utilities for exploiting vulnerability CVE-2022-40684 (FortiOS / FortiProxy / FortiSwitchManager - Authentication bypass on administrative interface).) (October 20, 2022)
- Exploit #8497 - Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass. (October 19, 2022)
- Exploit #8488 - CVE-2022-40684 () (October 17, 2022)
- Exploit #8487 - Fortinet-CVE-2022-40684 () (October 17, 2022)
- Exploit #8484 - CVE-2022-40684 () (October 16, 2022)
- Exploit #8482 - cve-2022-40684 (exploit for CVE-2022-40684 Fortinet) (October 16, 2022)
- Exploit #8477 - Fortinet-PoC-Auth-Bypass (Bash PoC for Fortinet Auth Bypass - CVE-2022-40684) (October 16, 2022)
- Exploit #8474 - CVE-2022-40684 () (October 16, 2022)
- Exploit #8472 - CVE-2022-40684-POC (Exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager) (October 16, 2022)
- Exploit #8471 - CVE-2022-40684 () (October 16, 2022)
- Exploit #8470 - CVE-2022-40684 (Exploit for CVE-2022-40684 vulnerability) (October 16, 2022)
- Exploit #8469 - CVE-2022-40684 (PoC for CVE-2022-40684 - Authentication bypass lead to Full device takeover (Read-only)) (October 13, 2022)
- Exploit #8468 - CVE-2022-40684 (A proof of concept exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager) (October 13, 2022)
- Exploit #8467 - CVE-2022-40684.py (October 13, 2022)