CVE report
CVE-2022-40684criticalKEV
Fortinet - Authentication Bypass
Events 90d
103
Distinct IPs
52
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2022-40684 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /api/v2/cmdb/system/admin/admin
- · /api/v2/cmdb/system/admin
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 22 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2022-40684
- 66.228.53.1052 eventsUnited States
- 45.79.207.142 eventsUnited States
- 159.89.55.592 eventsUnited States
- 50.116.30.1892 eventsUnited States
- 194.195.211.1992 eventsUnited States
- 74.207.254.1272 eventsUnited States
- 74.207.243.862 eventsUnited States
- 159.65.226.1562 eventsUnited States
- 165.22.150.1722 eventsUnited States
- 147.182.179.262 eventsUnited States
- 167.99.151.1642 eventsUnited States
- 134.122.36.2552 eventsCanada
- 139.177.205.432 eventsUnited States
- 66.228.47.1112 eventsUnited States
- 170.64.146.1802 eventsAustralia
- 31.59.160.32 eventsUnited Arab Emirates· Miteflux Technologies Ltd
- 165.227.23.22 eventsUnited States
- 192.81.131.1402 eventsUnited States
- 165.227.21.392 eventsUnited States
- 74.207.252.1092 eventsUnited States
- 66.228.47.402 eventsUnited States
- 45.79.103.442 eventsUnited States
- 178.128.179.482 eventsUnited States
- 134.209.56.52 eventsUnited States
- 159.223.143.192 eventsUnited States
- 23.239.12.2142 eventsUnited States
- 157.230.180.2262 eventsUnited States
- 167.172.121.2142 eventsUnited States
- 142.93.250.472 eventsUnited States
- 45.56.72.2392 eventsUnited States
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
Sample request paths observed
- /api/v2/cmdb/system/admin
- /api/v2/cmdb/system/admin/admin