CVE-2022-41333

published 2023-03-07

CVE-2022-41333: An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may…

Priority P2 60 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

EXPLOIT

An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortirecorder	—	—
fortinet	fortirecorder	6.0.0 – 6.0.11	—
fortinet	fortirecorder	6.4.0 – 6.4.3	—
fortinet	fortirecorder_firmware	6.0.0 – 6.0.11	—
fortinet	fortirecorder_firmware	6.4.0 – 6.4.3	—
fortinet	fortirecorderfirmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /module/admin.fe↗

url /module/admin.fe?fewReq=↗

• → Detect repeated GET or POST requests to /module/admin.fe (with fewReq parameter) from unauthenticated sources; high-frequency loops indicate DoS exploitation attempt. ↗
• → Alert on HTTP requests to FortiRecorder login endpoint /module/admin.fe carrying the User-Agent string 'CVE-2022-41333', which is hardcoded in the public exploit. ↗
• → Monitor for POST requests to /module/admin.fe with body parameter 'fewReq=' from unauthenticated clients in rapid succession, consistent with resource exhaustion against the login authentication mechanism. ↗
• → Successful exploit responses contain the string 'Failed: Access denied'; correlate high volumes of such responses from a single source IP against /module/admin.fe as a DoS indicator. ↗

• · The vulnerability is unauthenticated and exploitable via crafted GET (or POST) requests; no credentials are required, so network-perimeter blocking of unauthenticated access to /module/admin.fe is the primary mitigation until patching. ↗
• · Affected versions span two branches: FortiRecorder 6.4.3 and below, and 6.0.11 and below (down to 6.0.0); both branches must be patched. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400