{"cveID":"CVE-2022-41328","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS Path Traversal Vulnerability","dateAdded":"2023-03-14","shortDescription":"Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.","requiredAction":"Apply updates per vendor instructions.","dueDate":"2023-04-04","knownRansomwareCampaignUse":"Unknown","notes":"https://www.fortiguard.com/psirt/FG-IR-22-369;  https://nvd.nist.gov/vuln/detail/CVE-2022-41328","cwes":["CWE-22"],"year":2022,"state":"mapped","stale_reasons":[],"mappings":[{"domain":"enterprise","cve":"CVE-2022-41328","technique":"T1574","technique_name_at_mapping":"Hijack Execution Flow","mapping_type":"exploitation_technique","capability_group":"dir_traversal","comments":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","references":["https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2022-41328","technique":"T1037","technique_name_at_mapping":"Boot or Logon Initialization Scripts","mapping_type":"primary_impact","capability_group":"dir_traversal","comments":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","references":["https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2022-41328","technique":"T1049","technique_name_at_mapping":"System Network Connections Discovery","mapping_type":"secondary_impact","capability_group":"dir_traversal","comments":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","references":["https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"},{"domain":"enterprise","cve":"CVE-2022-41328","technique":"T1565.001","technique_name_at_mapping":"Stored Data Manipulation","mapping_type":"secondary_impact","capability_group":"dir_traversal","comments":"CVE-2022-41328 is a path traversal vulnerability that allows a privileged attacked to read and write to files on the underlying Linux system via crafted CLI commands. Adversaries have been observed modifying files that establish persistence upon boot. The malicious files provide the adversaries with the capabilities of: data exfiltration, download/write files, remote shell, and discovery of network connections.","references":["https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis"],"status":"complete","source_file":"kev-07.28.2025_attack-16.1-enterprise.json","attack_version":"16.1","kev_snapshot":"07/28/2025"}],"techniques":[{"id":"T1037","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Boot or Logon Initialization Scripts","name_at_mapping":"Boot or Logon Initialization Scripts","renamed":false,"revoked_by":null,"mapping_types":["primary_impact"],"sigma_rule_count":0,"has_detection_strategy":true},{"id":"T1049","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"System Network Connections Discovery","name_at_mapping":"System Network Connections Discovery","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":9,"has_detection_strategy":true},{"id":"T1565.001","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Stored Data Manipulation","name_at_mapping":"Stored Data Manipulation","renamed":false,"revoked_by":null,"mapping_types":["secondary_impact"],"sigma_rule_count":6,"has_detection_strategy":true},{"id":"T1574","domains":["enterprise"],"in_current_bundle":true,"live":true,"name_now":"Hijack Execution Flow","name_at_mapping":"Hijack Execution Flow","renamed":false,"revoked_by":null,"mapping_types":["exploitation_technique"],"sigma_rule_count":8,"has_detection_strategy":true}],"mapping_types":["exploitation_technique","primary_impact","secondary_impact"],"has_exploitation_technique":true,"mapping_attack_versions":["16.1"],"mapping_domains":["enterprise"],"sigma_coverage":"partial","sigma_rules_tagged_cve":[],"added_after_mapping_snapshot":false,"_source":"kevmap","_built":"2026-08-23 05:47 UTC","_attack_version":"19.2"}