CVE-2022-39952

CVE-2022-39952 is a critical vulnerability in Fortinet's network access control suite, FortiNAC. This flaw, which resides in the software design or implementation, could lead to arbitrary code execution, posing a severe threat to network security. The vulnerability was identified and addressed by Fortinet four months after the detection of another significant bug in FortiNAC. The severity of CVE-2022-39952 is underscored by its CVSS score of 9.8, indicating a high level of potential impact. Security researchers at Horizon3.ai released a proof-of-concept (PoC) exploit for CVE-2022-39952, demonstrating the feasibility of exploiting this vulnerability. Within six days of the PoC exploit release, attacks targeting this vulnerability were detected. The quick exploitation timeline underscores the urgency required in patching such vulnerabilities to prevent potential breaches. The Earth Lusca group leveraged CVE-2022-39952 along with several other critical vulnerabilities for their attacks. These include an authentication bypass vulnerability (CVE-2022-40684) and multiple remote code execution vulnerabilities (CVE-2021-22205, CVE-2019-18935, CVE-2019-9670, and CVE-2019-9621). Therefore, organizations using FortiNAC are advised to apply patches for CVE-2022-39952 and related vulnerabilities promptly to protect their systems from potential exploits.