CVE-2022-39952

—

CVSS 3.1

9.8 critical

EPSS

100%p100

Published

Feb 16, 2023 (Feb 16, 2023)

Modified

Jun 17, 2026

Description

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request.

Vendors: fortinet
Products: fortinac
Weakness: CWE-73, CWE-668
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (99.8%)

In the news12 stories

CVE-2022-39952: Pre-authentication Code-execution Vulnerability

Recorded FutureJun 27, 00:00 UTC · Jun 27, 2025Vulnerability CVE-2022-399521

Earth Lusca expands its arsenal with SprySOCKS Linux malware

Security AffairsSep 19, 07:52 UTC · Sep 19, 2023Malware CVE-2022-40684 CVE-2022-39952 CVE-2021-22205+6 CVEs1

New Fortinet's FortiNAC Vulnerability Exposes Networks to Code Execution Attacks

The Hacker NewsJun 27, 05:35 UTC · Jun 27, 2023Vulnerability in the wildCVE-2023-33299 CVE-2023-33300 CVE-2023-27997+2 CVEs

New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access

The Hacker NewsMar 9, 05:23 UTC · Mar 9, 2023Exploit / PoC in the wildCVE-2023-25610 CVE-2022-39952 CVE-2021-42756

Week in review: ChatGPT and cybersecurity, hidden vulnerabilities in Docker containers

Help Net SecurityFeb 26, 00:00 UTC · Feb 26, 2023Vulnerability CVE-2023-20858 CVE-2022-39952

Fortinet FortiNAC CVE-2022-39952 flaw exploited in the wild hours after release of PoC exploit

Security AffairsFeb 23, 19:45 UTC · Feb 23, 2023Exploit / PoC in the wildCVE-2022-39952 CVE-2021-42756

Fortinet Issues Patches for 40 Flaws Affecting FortiWeb, FortiOS, FortiNAC, and FortiProxy

The Hacker NewsFeb 23, 03:50 UTC · Feb 23, 2023Vulnerability in the wildCVE-2022-39952 CVE-2021-42756

PoC exploit code for critical Fortinet FortiNAC bug released online

Security AffairsFeb 21, 21:05 UTC · Feb 21, 2023Exploit / PoC CVE-2022-39952 CVE-2021-427561

PoC exploit, IoCs for Fortinet FortiNAC RCE released (CVE-2022-39952)

Help Net SecurityFeb 21, 00:00 UTC · Feb 21, 2023Exploit / PoC in the wildCVE-2022-39952

Fortinet plugs critical security hole in FortiNAC, with a PoC incoming (CVE-2022-39952)

Help Net SecurityFeb 20, 00:00 UTC · Feb 20, 2023Exploit / PoC in the wildCVE-2022-39952 CVE-2021-42756 CVE-2022-42475

Fortinet fixes critical vulnerabilities in FortiNAC and FortiWeb

Security AffairsFeb 17, 15:09 UTC · Feb 17, 2023Vulnerability CVE-2022-39952 CVE-2021-42756

Earth Lusca's New SprySOCKS Linux Backdoor Targets Government Entities

The Hacker NewsSep 20, 04:37 UTC · Sep 20, 2023Malware CVE-2022-39952 CVE-2022-40684 CVE-2021-22205+3 CVEs