CVE-2022-27482
📋 TL;DR
This CVE describes an OS command injection vulnerability in Fortinet FortiADC that allows authenticated attackers to execute arbitrary shell commands with root privileges via CLI commands. The vulnerability affects multiple versions of FortiADC across several major releases. Attackers with CLI access can gain complete control of affected devices.
💻 Affected Systems
- Fortinet FortiADC
📦 What is this software?
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the FortiADC device with root-level access, allowing attackers to steal credentials, intercept/modify traffic, pivot to internal networks, and establish persistent backdoors.
Likely Case
Privilege escalation from authenticated CLI user to root, enabling configuration changes, traffic interception, and lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, CLI access restrictions, and monitoring are in place, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires authenticated CLI access. The vulnerability is in command parsing, making exploitation straightforward for attackers with CLI credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.0.2, 6.2.3, 6.1.7, and later versions
Vendor Advisory: https://fortiguard.com/psirt/FG-IR-22-046
Restart Required: Yes
Instructions:
1. Download the patched firmware from Fortinet support portal. 2. Backup current configuration. 3. Upload and install the patched firmware. 4. Reboot the device. 5. Verify the new version is running.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to trusted administrators only using access control lists and strong authentication.
config system admin
edit <admin_user>
set trusthost1 <trusted_ip> <mask>
end
Network Segmentation
allIsolate FortiADC management interfaces from untrusted networks and implement strict firewall rules.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiADC management interfaces
- Enforce multi-factor authentication and least privilege access for CLI users
- Monitor CLI access logs for suspicious activity and command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check FortiADC firmware version via CLI: 'get system status' and compare against affected versions.Check Version:
get system status | grep VersionVerify Fix Applied:
After patching, verify firmware version is 7.0.2+, 6.2.3+, 6.1.7+, or later unaffected version.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI command sequences
- Multiple failed authentication attempts followed by successful login
- Execution of system commands via CLI
Network Indicators:
- Unexpected outbound connections from FortiADC management interface
- Traffic patterns indicating command and control activity
SIEM Query:
source="fortiadc" AND (event_type="cli_command" AND command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*")