Security Experts:

Connect with us

Hi, what are you looking for?



Fortinet Confirms Zero-Day Vulnerability Exploited in One Attack

Fortinet has confirmed that the critical vulnerability whose existence came to light last week is a zero-day flaw that has been exploited in at least one attack.

Fortinet has confirmed that the critical vulnerability whose existence came to light last week is a zero-day flaw that has been exploited in at least one attack.

The company privately informed some customers last week about the availability of patches and workarounds for an authentication bypass vulnerability exposing FortiOS and FortiProxy products to remote attacks.

The flaw, tracked as CVE-2022-40684, can allow a remote, unauthenticated attacker to perform unauthorized operations on the targeted appliance’s admin interface using specially crafted HTTP or HTTPS requests.

Fortinet on Monday made public an advisory for CVE-2022-40684 and warned that it’s aware of one attack involving exploitation of the zero-day. The company has provided an indicator of compromise (IoC) that customers can use to check if their appliances have been hacked.

It’s likely that exploitation of the vulnerability occurred before Fortinet released a patch. Limited exploitation of a security flaw typically suggests that a sophisticated threat actor — likely a state-sponsored group — is behind the attacks.

However, details and proof-of-concept (PoC) exploits are expected to become publicly available in the coming days, which will allow other threat actors to add the exploit to their toolset.

Researcher Carlos Vieira said the vulnerability is “really simple to exploit and easy to weaponize” and warned that exploitation can lead to a full device takeover.

SANS Institute reported seeing an increase in scans for an old Fortigate vulnerability and the company believes someone may be trying to create a list of potential targets for CVE-2022-40684 exploitation.

According to Fortinet’s advisory, in addition to FortiProxy web gateways and security appliances running FortiOS, the flaw impacts FortiSwitch Manager, the management platform for FortiSwitch switches. Versions 7.0.x and 7.2 are affected and patches are included in versions 7.0.7, 7.2.1 and 7.2.2.

There are many vulnerable devices that are exposed to the internet, which makes widespread exploitation very likely. It’s not uncommon for threat actors to target Fortinet devices in their attacks.

Related: Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks

Related: Fortinet Patches High-Severity Vulnerabilities in Several Products

Related: Tens of Thousands of Unpatched Fortinet VPNs Hacked via Old Security Flaw

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.