Cloaked and Covert: Uncovering UNC3886 Espionage Operations
CVE-2022-41328 in FortiOS was exploited to download and execute backdoors on FortiGate devices.
CVE-2022-41328 KEV High · 7.1 EPSS 10.7%
Fortinet FortiOS Path Traversal Vulnerability
Fortinet · FortiOS
Summary
Fortinet FortiOS contains a path traversal flaw (CWE-22, improper limitation of a pathname to a restricted directory) affecting versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, and versions before 6.4.11. An attacker who already holds privileges on the device can use crafted CLI commands to read and write arbitrary files on the underlying Linux system, requiring local access with low-privilege authentication and no user interaction.
Official description · NVD
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
66.0 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 1
- Tactics
- 6/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 days after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+2 days
- Added to CISA KEVEU database agrees+7 days
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
4 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 4ExecutionTA0002
MITRE CTID mapping of the KEV entry · how it is exploited
CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.
PersistenceTA0003
MITRE CTID mapping of the KEV entry · primary impact
DiscoveryTA0007
MITRE CTID mapping of the KEV entry · follow-on activity
ImpactTA0040
Stored Data Manipulation T1565.001
MITRE CTID mapping of the KEV entry · follow-on activity
Detection
0 rules for this CVE · 23 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2022-41328 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Hijack Execution FlowT15748 general rules
- Exploiting SetupComplete.cmd CVE-2019-1378hightest
- Potential PrintNightmare Exploitation Attempthightest
- Suspicious Printer Driver Empty Manufacturerhightest
- DLL Execution Via Register-cimprovider.exemediumtest
- Potential Initial Access via DLL Search Order Hijackingmediumtest
- Potential Registry Persistence Attempt Via DbgManagedDebuggermediumtest
- Regsvr32 DLL Execution With Uncommon Extensionmediumtest
- Windows Spooler Service Suspicious Binary Loadinformationaltest
System Network Connections DiscoveryT10499 general rules
- HackTool - SharpView Executionhightest
- Potential Pikabot Discovery Activityhightest
- Cisco Discoverylowtest
- Net.EXE Executionlowtest
- System Network Connections Discovery - Linuxlowtest
- System Network Connections Discovery Via Net.EXElowtest
- Use Get-NetTCPConnectionlowtest
- Use Get-NetTCPConnection - PowerShell Modulelowtest
Stored Data ManipulationT1565.0016 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportGoogle Mandiant
Reports are matched by finding the exact id CVE-2022-41328 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX