{"id":"CVE-2022-41328","published":"2023-03-07T17:15:12Z","modified":"2026-06-17T05:03:02Z","title":"Fortinet FortiOS Path Traversal Vulnerability","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"description":{"text":"A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.","provenance":"source","from":"NVD"},"summary":{"text":"Fortinet FortiOS contains a path traversal flaw (CWE-22, improper limitation of a pathname to a restricted directory) affecting versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, and versions before 6.4.11. An attacker who already holds privileges on the device can use crafted CLI commands to read and write arbitrary files on the underlying Linux system, requiring local access with low-privilege authentication and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:54Z"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.10682,"percentile":0.95802,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2023-03-14","dueDate":"2023-04-04","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-22-369;  https://nvd.nist.gov/vuln/detail/CVE-2022-41328","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-03-09","exploitedFirstSeen":"2023-03-09","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis","date":"2023-03-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-03-14"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/fortinet-malware-ecosystem/","date":"2023-03-15"},{"url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem","date":"2023-03-16"},{"url":"https://www.mandiant.com/resources/blog/zero-days-exploited-2022","date":"2023-03-20"},{"url":"https://www.mandiant.com/resources/blog/chinese-espionage-tactics","date":"2023-07-18"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2023-1107.pdf","date":"2023-11-07"},{"url":"https://www.rapid7.com/blog/post/2024/02/12/etr-critical-fortinet-fortios-cve-2024-21762-exploited/","date":"2024-02-12"},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Year_in_Review_of_ZeroDays.pdf","date":"2024-03-27"}],"evidenceTotal":18,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-22-369","tags":["Vendor Advisory"]},{"url":"https://fortiguard.com/psirt/FG-IR-22-369","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41328","tags":["US Government Resource"]}],"techniques":[{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","confidence":"high"},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"primary_impact","evidence":[],"comment":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","confidence":"high"},{"id":"T1049","name":"System Network Connections Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","confidence":"high"},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Directory Traversal (Relative and Absolute)","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","confidence":"high"}],"reports":[{"id":"SRC-d520834e84b63932946c","title":"Cloaked and Covert: Uncovering UNC3886 Espionage Operations","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations","date":null,"mentions":[{"quote":"CVE-2022-41328 in FortiOS was exploited to download and execute backdoors on FortiGate devices.","start":3284,"end":3379}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-44535","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44535","exploited":true,"exploitedSince":"2023-03-14","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1574"],"provenance":"source"},{"stage":"primary","techniques":["T1037"],"provenance":"source"},{"stage":"secondary","techniques":["T1049","T1565.001"],"provenance":"source"}],"timeline":[{"date":"2023-03-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41328","provenance":"source"},{"date":"2023-03-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis","provenance":"source"},{"date":"2023-03-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-03-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-44535","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":7},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1332 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.16,"detail":"percentile 0.9580"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.97,"detail":"base score 7.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-fortinet-fortios-cwe-22"}}