9.8

CVE-2022-39952: fortinet fortinac External Control of File Name or Path

CVSS: 9.8v3.1CriticalModified
Published 16-02-2023Last modified 23-10-2024
Open JSON

Vulnerability summary

CVE-2022-39952 is a critical (CVSS 9.8) External Control of File Name or Path vulnerability in fortinet fortinac. EPSS estimates a 99.79% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
99.79%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1metasploit

Timeline

  1. 16-02-2023
    PublishedVulnerability first disclosed.
  2. 23-10-2024
    Last modifiedVulnerability information updated.

Description

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

99.79%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.79% on 20-09-2026

20-09-202620-10-2026
EPSS score
99.79%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • MetasploitMetasploitremoteVerified

    Fortinet FortiNAC keyUpload.jsp arbitrary file write

    exploit/linux/http/fortinac_keyupload_file_write

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Fortinet1 product
  • fortinac9.4.0 | ≥ 9.2.0, ≤ 9.2.5 | ≥ 9.1.0, ≤ 9.1.7 | ≥ 8.8.0, ≤ 8.8.11 | ≥ 8.7.0, ≤ 8.7.6 | ≥ 8.6.0, ≤ 8.6.5 | ≥ 8.5.0, ≤ 8.5.4 | 8.3.7 | ≥ 8.3.7, ≤ 8.8.9 | ≥ 9.1.0, < 9.1.8 | ≥ 9.2.0, < 9.2.6 | ≥ 9.4.0, < 9.4.1

1 vendor · 1 product

References

1 links