Description
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | Fortinet FortiOS, FortiProxy, FortiSwitchManager | FortiOS 7.2.1, 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiProxy 7.2.0, 7.0.6, 7.0.5, 7.0.4, 7.0.3, 7.0.2, 7.0.1, 7.0.0; FortiSwitchManager 7.2.0, 7.0.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Fortinet FortiOS, FortiProxy, and FortiSwitchManager authentication bypass.
exploit/linux/http/fortinet_authentication_bypass_cve_2022_40684
Exploit-DB 2
- Fortinet FortiOS_ FortiProxy_ and FortiSwitchManager 7.2.0 - Authentication bypass EDB-52239 · remote · Apr 16, 2025
- FortiOS_ FortiProxy_ FortiSwitchManager v7.2.1 - Authentication Bypass EDB-51092 · webapps · Mar 27, 2023
GitHub 31 repositories · most starred shown
-
horizon3ai/CVE-2022-40684 ★ 358 · Oct 13, 2022
A proof of concept exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager
-
arsolutioner/fortigate-belsen-leak ★ 87 · Jan 16, 2025
Research repository tracking affected IPs from the Fortigate CVE-2022-40684 configuration leak by Belsen Group
-
carlosevieira/CVE-2022-40684 ★ 87 · Oct 13, 2022
PoC for CVE-2022-40684 - Authentication bypass lead to Full device takeover (Read-only)
-
kljunowsky/CVE-2022-40684-POC ★ 16 · Oct 13, 2022
Exploit for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager
-
Filiplain/Fortinet-PoC-Auth-Bypass ★ 16 · Oct 13, 2022
Bash PoC for Fortinet Auth Bypass - CVE-2022-40684
-
TaroballzChen/CVE-2022-40684-metasploit-scanner ★ 14 · Oct 27, 2022
An authentication bypass using an alternate path or channel in Fortinet product
-
hughink/CVE-2022-40684 ★ 11 · Oct 28, 2022
-
qingsiweisan/CVE-2022-40684 ★ 9 · Oct 26, 2022
-
Chocapikk/CVE-2022-40684 ★ 7 · Oct 15, 2022
Fortinet Critical Authentication Bypass Vulnerability (CVE-2022-40684) [ Mass Exploit ]
-
secunnix/CVE-2022-40684 ★ 5 · Oct 14, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Fortinet - Authentication Bypass http/cves/2022/CVE-2022-40684.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.