SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
4 SOURCES ON THIS EVENT
◆ WATCHCVE-2022-39952 · CVSS 9.8

Fortinet FortiNAC: attackers can read or change files

AFFECTSFortinet FortiNAC

WHAT IT IS · VPN, FIREWALL OR GATEWAYIt sits at the edge of your network and faces the internet, so attackers can reach it directly.

DO THIS FIRSTIf you have it, patch it today. If you cannot, block access to it from the internet until you can. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

WHY THIS VERDICT Attack attempts are confirmed, with no confirmed exploitation yet.

WHY IT RANKS HERE The product faces the internet or gives remote access. Ready-made attack tools are public. The first report is 20 days old.

HIGHEST CONFIRMED RUNG
TRIED
CISA KEV
NOT YET
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    Attack attempts on CVE-2022-39952 seen by honeypots (Shadowserver via CIRCL).

  4. 04 EXPLOITED

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2022-39952 published
  2. EXPLOIT CODE PUBLIC
    DATE UNKNOWN
  3. FIRST ATTACK REPORT
    CIRCL Vulnerability-Lookup sightings
  4. CISA KEV LISTING
    NOT YET
  5. US FEDERAL DEADLINE
    NOT YET
Attacks were reported 1344 days after disclosure.
// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. FEB 15, 2023
    Metasploit exploit module: Fortinet FortiNAC keyUpload.jsp arbitrary file write
  2. FEB 20, 2023
    4 public GitHub repositories claim a proof of concept for CVE-2022-39952
  3. Attack activity. OCT 21, 2026
    Attack attempts on CVE-2022-39952 seen by honeypots (Shadowserver via CIRCL)

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Fortinet FortiNAC - Arbitrary File Write, OCT 24
  2. [2] CIRCL Vulnerability-Lookup sightings: Attack attempts on CVE-2022-39952 seen by honeypots (Shadowserver via CIRCL), OCT 21
  3. [3] PoC-in-GitHub: 4 public GitHub repositories claim a proof of concept for CVE-2022-39952, FEB 20
  4. [4] Metasploit module metadata: Metasploit exploit module: Fortinet FortiNAC keyUpload.jsp arbitrary file write, FEB 15