{"id":"CVE-2022-39952","published":"2023-02-16T18:06:55Z","modified":"2024-10-23T14:32:41Z","title":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7…","vendor":"Fortinet","product":"FortiNAC","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiNAC","versions":["9.4.0",">= 9.2.0, <= 9.2.5",">= 9.1.0, <= 9.1.7",">= 8.8.0, <= 8.8.11",">= 8.7.0, <= 8.7.6",">= 8.6.0, <= 8.6.5",">= 8.5.0, <= 8.5.4","8.3.7"]}],"description":{"text":"A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.","provenance":"source","from":"CVE.org"},"summary":{"text":"Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, and 8.3.7 are affected by an external control of file name or path vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via a specifically crafted HTTP request.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:06Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.99794,"percentile":0.99957,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-07-05","exploitedFirstSeen":"2023-07-05","ransomware":false,"evidence":[{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-unveiling-findings-from-six-worldwide-locations/","date":"2023-07-05"},{"url":"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html","date":"2023-09-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-39952","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-16&host_type=src&vulnerability=cve-2022-39952","date":"2023-11-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-22&host_type=src&vulnerability=cve-2022-39952","date":"2023-11-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-27&host_type=src&vulnerability=cve-2022-39952","date":"2023-11-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-29&host_type=src&vulnerability=cve-2022-39952","date":"2023-11-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-11&host_type=src&vulnerability=cve-2022-39952","date":"2023-12-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-21&host_type=src&vulnerability=cve-2022-39952","date":"2023-12-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-22&host_type=src&vulnerability=cve-2022-39952","date":"2023-12-22"}],"evidenceTotal":761,"provenance":"source"},"exploited":true,"otx":{"pulseCount":13,"pulses":[{"name":"The Importance of Patching: An Analysis of the Exploitation of N-Day Vulnerabilities | Fortinet Blog","url":"https://otx.alienvault.com/pulse/65c6697edf92aee33c424165","created":"2024-02-09"},{"name":"Threat Trend Report on APT Groups - AhnLab Security Emergency response Center (ASEC)","url":"https://otx.alienvault.com/pulse/6551f2c1648b24256c944014","created":"2023-11-13"},{"name":"New SprySOCKS Linux malware used in cyber espionage attacks","url":"https://otx.alienvault.com/pulse/650c4de2a7f7db383234b794","created":"2023-09-21"},{"name":"Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement","url":"https://otx.alienvault.com/pulse/6509cd6cb1f6826dace407d7","created":"2023-09-19"},{"name":"Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement","url":"https://otx.alienvault.com/pulse/65099c7e0c55ce143083c8a6","created":"2023-09-19"},{"name":"Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement","url":"https://otx.alienvault.com/pulse/65098b95635a9b5e5f252e10","created":"2023-09-19"},{"name":"Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement","url":"https://otx.alienvault.com/pulse/6509445858ee78123ba0615a","created":"2023-09-19"},{"name":"Cyble - Critical Vulnerability in FortiNAC (CVE-2022-39952) Exposes Multiple Organizations to Cyberattacks","url":"https://otx.alienvault.com/pulse/63fdf011712df4e47e3fc680","created":"2023-02-28"},{"name":"Cyble &mdash; New WhiteSnake Stealer Offered for Sale Via MaaS Model","url":"https://otx.alienvault.com/pulse/63fd8d934a174e1f36ba46a0","created":"2023-02-28"},{"name":"Threat Intel Report - W9-2023","url":"https://otx.alienvault.com/pulse/63fc79b4bae60a56c58f0543","created":"2023-02-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-73","name":"External Control of File Name or Path"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-300","tags":[]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated HTTP request exploits public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"may allow an unauthenticated attacker to execute unauthorized code","start":210,"end":276}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker achieves arbitrary code/command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute unauthorized code or commands via specifically crafted HTTP request","start":251,"end":326}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-bf1b3fd29c4a38dbdb8c","title":"Picus-RedReport-2024","publisher":"picussecurity.com","url":"https://www.picussecurity.com/hubfs/Red%20Report%202024/Picus-RedReport-2024.pdf","date":null,"mentions":[{"quote":"For instance, the vulnerability CVE-2022-39952 in Fortinet's FortiNAC is exploited using","start":130776,"end":130864}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-42396","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42396","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2023-02-20","earliestUrl":"https://github.com/horizon3ai/CVE-2022-39952","repos":[{"name":"horizon3ai/CVE-2022-39952","url":"https://github.com/horizon3ai/CVE-2022-39952","stars":266,"created":"2023-02-20"},{"name":"Chocapikk/CVE-2022-39952","url":"https://github.com/Chocapikk/CVE-2022-39952","stars":3,"created":"2023-02-26"},{"name":"shiyeshu/CVE-2022-39952_webshell","url":"https://github.com/shiyeshu/CVE-2022-39952_webshell","stars":2,"created":"2023-02-22"},{"name":"dkstar11q/CVE-2022-39952-better","url":"https://github.com/dkstar11q/CVE-2022-39952-better","stars":0,"created":"2023-03-27"}]},"metasploit":[{"name":"Fortinet FortiNAC keyUpload.jsp arbitrary file write","module":"exploit/linux/http/fortinac_keyupload_file_write","type":"exploit","disclosureDate":"2023-02-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinac_keyupload_file_write.rb"}],"nuclei":[{"id":"CVE-2022-39952","name":"Fortinet FortiNAC - Arbitrary File Write","severity":"critical","path":"http/cves/2022/CVE-2022-39952.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39952.yaml"}],"first":{"date":"2023-02-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinac_keyupload_file_write.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2023-02-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-39952","provenance":"source"},{"date":"2023-02-16","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-02-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinac_keyupload_file_write.rb","provenance":"source"},{"date":"2023-07-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-unveiling-findings-from-six-worldwide-locations/","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":73.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1214 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.6,"detail":"13 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}