Fortinet · FortiOS
CVE-2022-41328
Fortinet FortiOS Path Traversal Vulnerability
攻撃で悪用
中 6.5 攻撃の可能性：11%
概要
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
CISA: Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
対処法
Apply updates per vendor instructions.
米国連邦機関の対応期限：2023年4月4日
Fortinetのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/07/27 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | 中 5.3 | 29% |
| 2025/06/25 | Use of Hard-Coded Credentials | FortiOS | 中 6.5 | 6.6% |
| 2024/02/09 | Out-of-Bound Write | FortiOS | 緊急 9.6 | 85% |
| 2022/12/13 | Heap-Based Buffer Overflow | FortiOS | 緊急 9.3 | 99.5% |
| 2021/12/10 | Arbitrary File Download | FortiOS | 低 3.3 | 0.9% |
| 2021/11/03 | Default Configuration | FortiOS | 中 6.5 | 19% |
| 2021/11/03 | SSL VPN Path Traversal | FortiOS | 緊急 9.1 | >99.9% |
| 2021/11/03 | SSL VPN Improper Authentication | FortiOS | 高 7.5 | 45% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。