CVE-2022-41328: Fortinet FortiOS Path Traversal Vulnerability

CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS. It may allow a local privileged attacker to read and write files by issuing crafted CLI commands. For IT and security teams, this matters because FortiOS commonly underpins firewalls, VPN gateways, and other network edge devices; unauthorized file access on those systems can expose configuration, credentials, or other sensitive data and enable further compromise of the device or the network it protects.

Public detail is limited to the CWE-22 classification and the CISA description above. Confirm exact impact, affected builds, and any additional conditions against the vendor advisory before acting.

How it works

The flaw belongs to the path traversal class (CWE-22). In this weakness, software fails to properly neutralize special elements such as directory traversal sequences in user-supplied input that is used to construct a file path. An attacker who already holds local privileged access can supply crafted CLI commands that cause the FortiOS component handling those commands to resolve paths outside the intended directories. Successful abuse lets the attacker read arbitrary files or write to locations that should be protected, potentially altering configuration, planting persistence, or extracting secrets. Exact command syntax and reachable paths are not detailed in the available summary; treat any CLI input that influences file operations as potentially dangerous until the vendor advisory is reviewed.

Am I affected? How to find it in your systems

FortiOS runs on Fortinet FortiGate appliances and related Fortinet network security products that provide firewall, VPN, and routing functions. These devices typically sit at network perimeters, in data centers, or as virtual instances in cloud environments.

• Inventory all Fortinet devices by querying management consoles, CMDB records, network discovery scans, and asset management tools for FortiOS hosts.
• Record the exact FortiOS version and build on each device (via the CLI or GUI) and compare it against the list of fixed versions published in the vendor advisory; do not rely on version ranges stated elsewhere.
• Identify devices that allow local privileged CLI access (console, SSH, or other administrative interfaces) and note whether those interfaces are reachable only from trusted management networks.
• Review authentication and privilege logs for unusual CLI sessions, unexpected file-system operations, or commands that reference atypical path strings. Because the attack requires local privileged access, focus telemetry on administrative activity rather than unauthenticated remote traffic.

If version or configuration details are unclear, treat the device as potentially affected until confirmed against the official advisory.

How to remediate

Apply the vendor-supplied updates for FortiOS exactly as directed in the Fortinet advisory for CVE-2022-41328. CISA’s required action is to apply updates per vendor instructions; prioritize devices that expose privileged CLI access.

• Schedule and test the update in a non-production environment if possible, then roll it out to production appliances following change-control procedures.
• After patching, re-verify the running FortiOS version and confirm that the vulnerable code path is no longer present.
• As general hardening for path-traversal and CLI-abuse classes, restrict administrative CLI access to dedicated management networks or jump hosts, enforce strong authentication (including multi-factor where supported), and limit the number of accounts that hold privileged rights.
• Disable unused administrative interfaces and ensure file-system permissions and integrity monitoring are enabled where the platform allows.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface and increase detection capability.

• Segment management interfaces so that only authorized administrative hosts can reach the CLI; block direct access from user or guest networks.
• If a web application firewall or IPS is in front of any management path, enable or tune signatures that detect directory-traversal patterns, understanding that this is a local CLI issue and network virtual patching may offer only partial coverage.
• Temporarily disable or tightly restrict any non-essential CLI features or remote management services that are not required for operations.
• Increase logging and monitoring of privileged CLI sessions, file-system changes, and configuration modifications; forward these logs to a SIEM and alert on anomalous activity.
• Review and rotate any credentials or keys that could be exposed if an attacker already has local privileged access.

These steps lower risk but do not eliminate the vulnerability; schedule the official patch as soon as operationally feasible.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to breaches in which configuration files, credentials, or other sensitive data are read or modified. Although ransomware use is not documented for this CVE, treat any confirmed exploitation as a potential data-exposure event. Review device logs for signs of unauthorized file access, reset affected credentials, and follow your incident-response plan. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related accounts appear in public breach compilations.