CVE-2022-41328

CVE-2022-41328 is a significant software vulnerability discovered in Fortinet's FortiOS. It was heavily targeted by China-nexus intrusion sets, particularly UNC3886, who exploited the vulnerability to deploy custom malware families on Fortinet and VMware systems. This exploitation occurred in September 2022, allowing the threat actors to write files directly to FortiGate firewall disks. The attackers also used the compromised appliances as a pivot point to gain access to ESXi infrastructure and subsequently to VM guests. The exploitation of CVE-2022-41328 was part of a broader campaign that involved several other zero-day vulnerabilities. For instance, Mandiant reported that the same group had previously exploited two Microsoft Exchange zero-day vulnerabilities (CVE-2022-41040 and CVE-2022-41082). In addition to this, the group leveraged another Fortinet zero-day vulnerability to install previously unknown Castletap and Thincrust backdoors onto FortiGate firewall devices. By March 2023, Fortinet had published security advisories addressing this high-severity security vulnerability. However, prior to these advisories, the suspected China-nexus threat actor had already gained persistent access to victim environments, deploying backdoors onto Fortinet and VMware solutions. The use of CVE-2022-41328 allowed the threat actors to bypass authentication and execute code with system privileges, demonstrating the serious nature of this vulnerability.