CVE-2022-40684

An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

99.98% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-10-11, used in ransomware campaigns

Nuclei

critical · CWE-287

Published

2022-10-18

Updated

2026-08-06

Proof-of-concept exploits (29)

• http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManage…
• http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
• Anthony1500/CVE-2022-406840★ · 2023-09-14
• Bendalledj/CVE-2022-406841★ · 2022-10-21
• Chocapikk/CVE-2022-406847★ · 2022-10-19
• ClickCyber/cve-2022-406840★ · 2022-10-15
• Filiplain/Fortinet-PoC-Auth-Bypass16★ · 2023-04-02
• HAWA771/CVE-2022-406842★ · 2022-10-15
• NeriaBasha/CVE-2022-406841★ · 2022-10-16
• XalfiE/Fortigate-Belsen-Leak-Dump-CVE-2022-40684-1★ · 2025-02-05
• Yami0x777/Belsen_Group-et-exploitation-de-la-CVE-2022-406840★ · 2025-02-20
• carlosevieira/CVE-2022-4068487★ · 2022-10-13
• dkstar11q/CVE-2022-406840★ · 2022-10-15
• gustavorobertux/gotigate2★ · 2022-10-28
• horizon3ai/CVE-2022-40684358★ · 2022-10-13
• hughink/CVE-2022-4068411★ · 2022-10-28
• iveresk/CVE-2022-406841★ · 2022-10-17
• jsongmax/Fortinet-CVE-2022-406842★ · 2022-10-17
• kljunowsky/CVE-2022-40684-POC16★ · 2023-01-21
• mhd108/CVE-2022-406840★ · 2022-10-14
• notareaperbutDR34P3r/CVE-2022-40684-Rust0★ · 2023-01-17
• puckiestyle/CVE-2022-406840★ · 2022-10-17
• qingsiweisan/CVE-2022-406849★ · 2022-10-26
• secunnix/CVE-2022-406845★ · 2022-10-14
• und3sc0n0c1d0/CVE-2022-406844★ · 2022-10-24
• z-bool/CVE-2022-406845★ · 2023-02-27
• ccordeiro/CVE-2022-40684
• 1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor
• tijldeneut/Security

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40684.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/fortinet_authenticati…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/52239
• https://www.exploit-db.com/exploits/51092

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-40684.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-42889
• CVE-2023-30330
• CVE-2021-26084
• CVE-2022-0847
• CVE-2022-22947
• CVE-2022-31814