CVE-2022-41328 is a medium security path traversal bug in FortiOS that could lead to arbitrary code execution. An improper limitation of a pathname to a restricted directory vulnerability ('path traversal') in FortiOS may allow a privileged attacker to read and write arbitrary files via crafted CLI commands.

Even if the vulnerability was not considered critical, it can be used to execute arbitrary code and Fortinet experts discovered an unknown advanced threat actor exploited it in attacks targeting governmental entities and government-related organizations.

A Fortinet report published last week revealed that CVE-2022-41328 exploits had been used to hack and take down multiple FortiGate firewall devices belonging to a customer. The attack was considered to be highly targeted and given the complexity of the exploit the threat actor has advanced capabilities to reverse engineer different aspects of the FortiOS operating system.