CVE-2022-43946: Fortinet FortiClient Privilege Escalation

CVE-2022-43946 Overview

CVE-2022-43946 affects Fortinet FortiClient for Windows versions before 7.0.7. The vulnerability combines two weaknesses: an incorrect permission assignment for a critical resource [CWE-732] and a time-of-check time-of-use (TOCTOU) race condition [CWE-367]. Attackers on the same file sharing network can exploit these flaws by writing data into a Windows named pipe. Successful exploitation allows arbitrary command execution in the context of the FortiClient service. The vulnerability impacts confidentiality, integrity, and availability of affected endpoints. Fortinet published the advisory under reference FG-IR-22-429.

Critical Impact
Network-adjacent attackers can execute commands on FortiClient Windows endpoints by abusing a misconfigured Windows pipe and racing the validation logic.

Affected Products

Fortinet FortiClient for Windows versions prior to 7.0.7
Fortinet FortiClient 7.0.0 through 7.0.6 on Windows
Fortinet FortiClient 6.4.x and earlier branches on Windows

Discovery Timeline

2023-04-11 - CVE-2022-43946 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-43946

Vulnerability Analysis

The vulnerability resides in FortiClient's inter-process communication layer on Windows. FortiClient exposes a named pipe used by privileged service components to receive instructions from local helpers. The pipe is created with permissive access controls, allowing unintended principals to connect and write data. Attackers reachable through Windows file sharing (SMB) can interact with the pipe across the network.

The second flaw is a TOCTOU race condition between the moment the service validates a request and the moment it acts on the underlying data. An attacker who wins the race can substitute attacker-controlled content after validation succeeds. Combining both issues lets a remote actor inject commands processed by the privileged FortiClient component.

Root Cause

The root cause is twofold. First, the named pipe is created with a security descriptor that grants write access beyond the trusted local service account [CWE-732]. Second, the validation routine reads request data, checks it, and then re-reads or re-uses it without an atomic guarantee [CWE-367]. The non-atomic check-then-use pattern creates an exploitable window.

Attack Vector

Exploitation requires network reachability to the target's file sharing surface and the ability to open a handle to the FortiClient named pipe. The attacker writes a crafted payload, then modifies the payload during the validation window. When the service consumes the data post-check, it executes attacker-controlled commands. No authentication or user interaction is required, although attack complexity is high due to the race timing.

No public proof-of-concept code is available for this vulnerability. Refer to the FortiGuard Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2022-43946

Indicators of Compromise

Unexpected SMB connections from external or untrusted hosts targeting endpoints running FortiClient
Anomalous child processes spawned by FortiClient service binaries such as FortiESNAC.exe or FortiSettings.exe
Unusual writes to FortiClient named pipes from non-local or non-service principals

Detection Strategies

Monitor process creation events where FortiClient service processes spawn command interpreters such as cmd.exe or powershell.exe
Audit named pipe creation and connection events using Sysmon Event IDs 17 and 18 filtered on FortiClient pipe names
Correlate inbound SMB sessions on TCP/445 with subsequent FortiClient pipe activity within short time windows

Monitoring Recommendations

Enable Windows Advanced Audit Policy for Object Access and Process Creation on endpoints running FortiClient
Forward endpoint telemetry to a central analytics platform for cross-host correlation of pipe abuse patterns
Alert on FortiClient version strings below 7.0.7 reported by asset inventory or EDR telemetry

How to Mitigate CVE-2022-43946

Immediate Actions Required

Upgrade Fortinet FortiClient for Windows to version 7.0.7 or later on all managed endpoints
Restrict inbound SMB (TCP/445) at host and perimeter firewalls to trusted management subnets only
Inventory all Windows endpoints running FortiClient and prioritize patching internet-exposed or roaming devices

Patch Information

Fortinet addressed both CWE-732 and CWE-367 weaknesses in FortiClient for Windows 7.0.7. The fix tightens the security descriptor on the affected named pipe and removes the non-atomic validation pattern. Consult the FortiGuard Security Advisory FG-IR-22-429 for the complete remediation matrix and download links.

Workarounds

Block TCP/445 inbound to FortiClient endpoints using Windows Defender Firewall rules until patching is complete
Segment endpoints onto networks where untrusted hosts cannot reach the SMB service
Disable the Server (LanmanServer) service on endpoints that do not require file sharing

bash

# Windows Defender Firewall rule to block inbound SMB on affected endpoints
netsh advfirewall firewall add rule name="Block-Inbound-SMB-CVE-2022-43946" \
  dir=in action=block protocol=TCP localport=445

# Verify installed FortiClient version
wmic product where "name like 'FortiClient%%'" get name,version