CVE-2022-41328

What it actually does

This is a path traversal vulnerability in Fortinet FortiOS CLI handling. A locally authenticated, privileged FortiOS administrator can submit crafted CLI commands containing traversal sequences or unexpected filesystem paths to escape the intended restricted directory and read from or write to files on the underlying Linux operating system. Successful exploitation can expose sensitive files such as configuration material, credentials, keys, logs, or system files, and can allow modification of files outside the intended FortiOS management scope. The flaw requires existing privileged access to the device but can materially increase the attacker’s control over the appliance.

Why it matters to the business

A compromised or malicious privileged account can use this flaw to access or alter sensitive files on FortiGate devices, potentially exposing VPN configuration, firewall policy data, secrets, certificates, and operational logs. Because FortiGate appliances often sit at network boundaries and enforce access controls, compromise can affect traffic inspection, remote access, incident response visibility, and trust in perimeter security. This vulnerability is listed in CISA KEV with known exploitation in the wild and had a required federal remediation date of 2023-04-04, so unpatched systems should be treated as high-priority exposure even though exploitation requires privileged access.

How an attack unfolds

An attacker first obtains privileged access to the FortiOS management plane, commonly through stolen administrator credentials, abuse of another vulnerability, exposed management interfaces, weak access controls, or insider access. After authenticating through SSH, console, or another administrative CLI path, the attacker issues crafted FortiOS CLI commands that include pathname traversal or direct references to filesystem locations outside the intended command directory. The vulnerable FortiOS path handling fails to properly constrain the requested path, allowing the command to read or write files on the underlying Linux system. The attacker may then collect configuration files, secrets, credentials, logs, certificates, or other sensitive artifacts, or modify files to weaken controls, hide activity, stage tooling, or prepare follow-on access. Because exploitation occurs through authenticated administrative activity, it may blend into normal management operations unless CLI command logging, administrator login history, and filesystem integrity signals are reviewed.

How to fix it

Upgrade affected Fortinet FortiOS versions to a fixed release. Based on the affected ranges, FortiOS 7.2.0 through 7.2.3 should be upgraded to 7.2.4 or later, FortiOS 7.0.0 through 7.0.9 should be upgraded to 7.0.10 or later, and FortiOS versions before 6.4.11 should be upgraded to 6.4.11 or later. Follow Fortinet’s upgrade path guidance for the specific appliance model and firmware train. If immediate upgrade is not possible, restrict administrative access to trusted management networks, disable internet-facing management interfaces, require MFA for administrator accounts where supported, remove unnecessary administrator accounts, enforce least privilege, rotate administrator credentials, and monitor all CLI activity for traversal patterns and unusual filesystem references.

How to confirm the fix worked

Confirm the FortiOS version running on each device and verify it is no longer in an affected range: not 7.2.0 through 7.2.3, not 7.0.0 through 7.0.9, and not earlier than 6.4.11. Validate through the FortiOS GUI, CLI version output, or centralized Fortinet management inventory. Confirm that management interfaces are not exposed to untrusted networks and that administrative access is limited to approved sources. Review administrator accounts and privilege levels after upgrade. Where possible, test command-line controls in a non-production device by confirming that traversal sequences such as ../ are rejected or cannot access files outside the intended command scope. Also verify that log forwarding to a SIEM remains active and that administrator login and command activity is being retained.

Typical attack path

1. Identify an exposed or reachable FortiOS management interface such as SSH, console access, or administrative management services.
2. Obtain privileged FortiOS credentials through phishing, credential reuse, prior compromise, misconfiguration, or insider access.
3. Authenticate to the FortiOS CLI with sufficient privileges.
4. Run crafted CLI commands containing traversal sequences or unexpected filesystem paths to escape the intended restricted directory.
5. Read sensitive files such as configuration data, credentials, keys, certificates, or logs from the underlying system.
6. Optionally write or modify files to alter device behavior, impair logging, stage persistence, or support additional compromise.
7. Use the collected information or modified device state for lateral movement, VPN access abuse, policy manipulation, or stealthy long-term access.

How to detect it

Review FortiOS event, system, administrator, SSH, console, configuration-change, and command history logs for privileged sessions that issued commands containing path traversal sequences or filesystem paths outside normal FortiOS administration workflows. Focus on successful or failed administrator logins from unusual source IPs, new or unexpected administrator accounts, changes to admin profiles, disabled logging, configuration exports, certificate changes, VPN changes, and firewall policy modifications near the time of suspicious CLI activity. Search centralized logs for traversal tokens such as ../, ..%2f, ..\, and references to Linux paths such as /etc/, /var/, /data/, /bin/, /root/, or /tmp/ in CLI command fields or administrative audit messages. Because this vulnerability requires privileged access, also correlate with credential-theft indicators: abnormal login times, impossible travel, repeated failed logins followed by success, logins from hosting providers or anonymization infrastructure, and sessions using rarely used administrator accounts. If compromise is suspected, compare current configuration and administrator lists against known-good backups, review file integrity where available, validate certificates and VPN objects, and treat local logs as potentially incomplete if the attacker had write capability.

• ../
• ..%2f
• ..%2F
• ..\\
• /etc/passwd
• /etc/shadow
• /etc/
• /var/
• /data/
• /bin/sh
• /root/
• /tmp/
• ui=ssh
• ui=console
• subtype=admin
• action=login
• action=logout
• Administrator login successful
• Administrator login failed
• config system admin
• set accprofile
• config vpn certificate
• execute backup
• execute restore

What your security team should do

• Patch or upgrade all affected FortiOS devices immediately, prioritizing internet-facing or remotely administered appliances because the vulnerability is in the CISA Known Exploited Vulnerabilities catalog.
• Inventory all FortiGate and FortiOS appliances and confirm firmware versions against the affected ranges.
• Restrict administrative management access to dedicated management networks, VPN-only access, or hardened jump hosts; remove public internet exposure for administrative services.
• Rotate FortiOS administrator passwords and API keys, especially where privileged credentials may have been exposed or reused.
• Audit administrator accounts for unknown, dormant, recently created, or over-privileged users.
• Review FortiOS system, event, administrator, SSH, console, and configuration-change logs for suspicious CLI activity containing path traversal sequences or direct references to Linux filesystem paths.
• Check for unexpected configuration changes, modified certificates, changed VPN settings, altered firewall policies, disabled logging, or unusual backup/export activity.
• Ensure FortiOS logs are forwarded to centralized logging before remediation where possible, because local logs may be altered by a privileged attacker.
• If exploitation is suspected, preserve logs and configuration, isolate management access, reimage or factory-reset the appliance if integrity cannot be trusted, restore from a known-good configuration, and rotate downstream secrets such as VPN credentials and certificates.