Actively exploited in the wild
Fortinet Multiple Products Authentication Bypass Vulnerability
Fortinet - Multiple Products · Listed in the CISA KEV since 2022-10-11. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-40684
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
Risk Assessment
An unauthenticated attacker could take control of the device, alter configuration, or access sensitive data.
Recommendation
Update the software to a patched version. Restrict access to the administrative interface to trusted networks only.
Original NVD description (English source)
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.