by Kastro
Paper/Archive/CVE-2023-45590

CVE-2023-45590

Fortinet FortiClientLinux — An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 t…

EPSS 2%CVSS 9.4
critical.is priorityof 100
43
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 74.7.747 × 2014.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website

Affected

ProductAffectedFixed inSource
FortiClientLinux7.2.0–CNA
FortiClientLinux7.0.6 – 7.0.10–CNA
FortiClientLinux7.0.3 – 7.0.4–CNA
forticlient< 7.0.107.0.10CISA-ADP
forticlient7.0.3 – < 7.0.47.0.4CISA-ADP
forticlient7.2.0–CISA-ADP

Scores by source

fortinet (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-087