CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 14 March 2023, which means attackers have used it in real attacks. Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
What this vulnerability means in FortiOS
Path traversal in FortiOS means a privileged local attacker can try to break out of intended file paths and reach files or directories the product should not expose. In a network security platform, that matters because file access can become a stepping stone to configuration theft, system tampering, or deeper appliance compromise.
This class of flaw is especially dangerous on edge devices and security appliances because they often sit at a trust boundary, hold sensitive configuration data, and are administered through privileged interfaces. Even when the initial requirement is local privilege, successful exploitation can convert limited access into a much broader system-level foothold.
Why path traversal is security-relevant
Path traversal is not just a file-reading bug. On an appliance, reading arbitrary files may expose secrets, logs, configuration state, or internal service data, while write access can alter behaviour, persistence, or recovery options. The practical risk is that a vulnerability in file handling can undermine the confidentiality and integrity of the entire device.
For readers mapping this to broader vulnerability practice, the important question is not only whether the issue exists, but whether the vulnerable product is exposed in production, whether privileged access is realistically obtainable, and whether the appliance stores reusable credentials or other sensitive operational material.
When reviewing a real-world vulnerability record, use the authoritative CVE Program entry and the NIST National Vulnerability Database for canonical identification, record metadata, and downstream tracking.
How organisations check exposure and contain blast radius
Exposure review starts with asset inventory: identify every FortiOS instance, where it is deployed, who administers it, and whether it is reachable through management interfaces or other privileged access paths. If a device is internet-facing, or reachable from broader internal networks than intended, the urgency of review increases.
Organisations should also compare deployed builds against the vendor advisory and KEV status rather than relying on generic vulnerability scanning alone. A device that appears “patched enough” may still be operationally exposed if the advisory has not been applied correctly, if compensating controls are weak, or if administrative access is too broad.
To prioritise remediation, align vulnerability handling with a structured process such as Vulnerability Management Guide, which covers asset scope, KEV prioritisation, exceptions, verification, and remediation metrics.
Remediation, detection, and post-exploitation review
Remediation should follow the vendor advisory and CISA KEV guidance first, because those sources define the authoritative patch and mitigation path for the exact product release. If a patch cannot be applied immediately, reduce attack surface by restricting administrative reachability, tightening privilege boundaries, and monitoring for unusual CLI activity or unexpected file changes.
Detection should focus on signs that the appliance was already accessed in a way that matches the vulnerability’s impact, not just on proof of exploitation at the network edge. Review logs, recent configuration changes, file integrity signals, and any unexpected additions, deletions, or edits in sensitive directories.
If exploitation is suspected, treat credential exposure and configuration theft as possible follow-on consequences. FortiOS appliances often carry management secrets or trusted access paths, so a compromise review should include password rotation, secret replacement, and validation that no unauthorized persistence remains.
Risk and Threat Considerations
This vulnerability is high-risk because it affects a privileged interface on a security appliance, where file access can translate into durable control or sensitive data exposure. The threat is not just that an attacker can read or write files, but that they may use that access to alter trust settings, harvest secrets, or stage further compromise.
Failure mechanism: A local privileged attacker abuses path handling in crafted CLI commands to escape intended file boundaries and reach protected files or writable locations.
Impact: Attackers may expose configuration data, tamper with appliance state, or use the device as a pivot point for broader compromise, persistence, or credential theft.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | Path traversal in FortiOS requires rapid vulnerability remediation. |
| CM-6 — Configuration Settings | Mitigation depends on tightening appliance configuration and admin exposure. | |
| AU-6 — Audit Review, Analysis, and Reporting | Detection and compromise review rely on log review and anomaly investigation. | |
| Recommendation — Track the FortiOS flaw under SI-2 and verify remediation on every affected appliance. Apply CM-6 to harden FortiOS management settings and reduce reachable attack surface. Use AU-6 to review appliance logs for suspicious CLI use, file access, and configuration changes. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed FortiOS flaws require prioritised identification and remediation. |
| Recommendation — Use CIS-7 to inventory, prioritize, and remediate exposed FortiOS instances quickly. | ||
| MITRE ATT&CK | T1005 — Data from Local System | Path traversal can expose files and local data from the appliance. |
| Recommendation — Map suspicious file access to T1005 and hunt for local data collection on the appliance. | ||
Practitioner Guidance
Why practitioners should care: FortiOS sits in a high-trust position, so even a vulnerability that requires local privilege can have outsized impact on confidentiality and integrity. Teams should treat the appliance as security infrastructure, not as an ordinary host, when they assess urgency and compensating controls.
What to watch for: Unusual CLI activity, unexpected file modifications, changed admin behaviour, or unexplained configuration drift deserve immediate review, especially if the device has been exposed to untrusted administrative access.
Practitioner takeaway: For KEV-listed appliance flaws, remediation and post-exploit review should be treated as one workstream, because patching alone does not prove the device was never abused.