CVE-2022-40684

This vulnerability is like a locked door where an attacker finds a hidden shortcut into the office—without needing a key (no login). Once inside, they can perform administrative actions on the system over the network, which can lead to control of your security gateway and help attackers disrupt services or steal data.

This matters if your business uses Fortinet FortiOS, FortiProxy, or FortiSwitchManager (including management/administration features) in the affected versions listed by this alert. Because the attacker does not need to log in and the attack happens over the network, exposure is most likely when the administrative interface is reachable from the internet or any untrusted network. Treat it as a risk wherever the vulnerable administrative features can be reached without authentication.

This is RED because real-world exploitation is confirmed in a CISA KEV entry and is reported as used in ransomware campaigns. Attackers can hit the administrative interface from the network without authentication, making it extremely actionable for intrusions.

Confirm exposure

1. Identify whether you have any of the affected products: Fortinet FortiOS, FortiProxy, or FortiSwitchManager.
2. For each device, record the exact running version.
3. Compare versions against the affected ranges:
   • FortiOS: 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6
   • FortiProxy: 7.2.0 and 7.0.0 through 7.0.6
   • FortiSwitchManager: 7.2.0 and 7.0.0 through 7.0.6

Upgrade (primary remediation)

1. Upgrade FortiOS to 7.0.7 if you are in 7.0.0–7.0.6 or 7.2.0–7.2.1.
2. Upgrade FortiProxy to 7.0.7 if you are in the affected FortiProxy ranges.
3. Apply updates following Fortinet’s official instructions (trusted sources).
4. After upgrade, confirm the running version reflects the fixed release.

Workaround if you cannot upgrade immediately

1. Follow the vendor workaround guidance provided in Fortinet’s FortiGuard PSIRT page: https://fortiguard.com/psirt/FG-IR-22-377
2. In parallel, reduce exposure by ensuring the administrative interface is not reachable from the internet and is restricted to only trusted management networks/hosts.

Validate and monitor

1. Review logs around the time window for suspicious unauthenticated HTTP/HTTPS requests to administrative endpoints.
2. Check for signs of unexpected administrative changes or configuration updates.
3. If you use central monitoring, ensure alerts are set for abnormal management/API request patterns.

CISA guidance / timeline

• CISA KEV entry: added 2022-10-11 with remediation due 2022-11-01 (follow vendor update instructions as the corrective action).

Severity is critical (reported with high impact across confidentiality, integrity, and availability). The core weakness is an authentication bypass (CWE-288 / described as CWE-287 in the title) where an unauthenticated attacker can send specially crafted HTTP or HTTPS requests to an administrative interface path/channel and perform administrative operations.

Exploitation status: confirmed by CISA KEV (listed as used in ransomware campaigns) and news/incident reporting indicates exploitation is happening in the wild; exploitation has been observed and weaponized with public exploits available.

Attack vector: network-based; no user interaction required and no authentication required.

KEV meaning here: CISA has identified this vulnerability as exploited in the wild and expects organizations to remediate according to vendor instructions by the listed due date.

Exploit maturity: public exploits exist (not limited to proof-of-concept). The vulnerability is therefore highly actionable once reachable.