FortiOS / FortiProxy / FortiSwitchManager CVE-2022-40684 (authentication bypass on the admin interface, CVSS 9.8, CISA KEV, FG-IR-22-377): which versions are fixed and how do I check for the rogue 'fortigate-tech-support' admin?

What it is: CVE-2022-40684, published by Fortinet on October 10, 2022, is an authentication bypass in the HTTP/HTTPS administrative interface of FortiOS, FortiProxy and FortiSwitchManager. An unauthenticated attacker who can reach the admin interface can perform admin operations with crafted requests. Fortinet confirmed exploitation; attackers downloaded device configurations and created a rogue super-admin account. It's in CISA's KEV catalog, and Fortinet management interfaces exposed to the internet are still scanned for it. Am I affected: - FortiOS 7.2.0-7.2.1 and 7.0.0-7.0.6; FortiProxy 7.2.0 and 7.0.0-7.0.6; FortiSwitchManager 7.2.0 and 7.0.0. - FortiOS 6.4 and 6.2 and FortiProxy 2.0 and 1.x are not affected by this CVE (but are old; check their own advisories). - Risk depends on whether the HTTP/HTTPS admin interface is reachable from untrusted networks. Check the version with get system status. Fix: 1. Upgrade: FortiOS 7.2.2+ or 7.0.7+ (FG-6000F/7000E/F: 7.0.5 B8001 or later), FortiProxy 7.2.1+ or 7.0.7+, FortiSwitchManager 7.2.1+ or 7.0.1+. Today, prefer the latest release on a supported branch, since later admin-interface and SSL-VPN bugs were fixed too. Use Fortinet's upgrade path tool. 2. Until patched, Fortinet's workaround: disable HTTP/HTTPS administrative access, or allow it only from trusted management IPs (on FortiOS with a local-in policy that permits a trusted address group and denies everything else; on FortiProxy with trusted hosts on the management interface). 3. Check for compromise using Fortinet's indicators: log entries containing user=Local_Process_Access, and an unexpected admin account named fortigate-tech-support with the super_admin profile. If either is present, treat the device as compromised and follow Fortinet support guidance: remove unknown accounts, review the configuration (VPN users, policies, SSH keys), restore a known-good configuration and rotate all admin, VPN and LDAP/RADIUS credentials that were in the configuration. Verify: get system status shows a fixed (preferably current) release, the admin list contains only known accounts, and the admin interface isn't reachable from the internet. Sources: https://www.fortiguard.com/psirt/FG-IR-22-377 https://nvd.nist.gov/vuln/detail/CVE-2022-40684 https://www.cisa.gov/known-exploited-vulnerabilities-catalog