Fortinet is warning that its FortiClientEMS software contains a critical security vulnerability that could allow an attacker to execute code on an affected system.
“Improper neutralization of special elements used in SQL command (“SQL injection”) vulnerabilities [CWE-89] FortiClientEMS could allow an unauthenticated attacker to execute unauthorized code or commands via a specially crafted request,” the company said in an advisory.
This vulnerability is numbered CVE-2023-48788 and has a CVSS rating of 9.3 (out of 10). It affects the following versions –
- FortiClientEMS 7.2.0 to 7.2.2 (upgrade to 7.2.3 or later)
- FortiClientEMS 7.0.1 to 7.0.10 (upgrade to 7.0.11 or later)
Horizon3.ai, where plan More technical details and a proof-of-concept (PoC) vulnerability will be released next week, indicating that the flaw can be exploited to obtain remote code execution on the server as a system.
Fortinet credits the ForticlientEMS development team and Thiago Santana of the UK’s National Cyber Security Center (NCSC) for discovering and reporting the flaw.
The company also fixed two other critical bugs (CVE-2023-42789 and CVE-2023-42790, CVSS score: 9.3) in FortiOS and FortiProxy that could allow attackers with access to the captive portal to perform arbitrary Code or command crafted HTTP request.
The following product versions are affected by this flaw –
- FortiOS version 7.4.0 to 7.4.1 (upgrade to FortiOS version 7.4.2 or later)
- FortiOS version 7.2.0 to 7.2.5 (upgrade to FortiOS version 7.2.6 or later)
- FortiOS version 7.0.0 to 7.0.12 (upgrade to FortiOS version 7.0.13 or later)
- FortiOS version 6.4.0 to 6.4.14 (upgrade to FortiOS version 6.4.15 or later)
- FortiOS version 6.2.0 to 6.2.15 (upgrade to FortiOS version 6.2.16 or higher)
- FortiProxy version 7.4.0 (upgrade to FortiProxy version 7.4.1 or later)
- FortiProxy version 7.2.0 to 7.2.6 (upgrade to FortiProxy version 7.2.7 or later)
- FortiProxy version 7.0.0 to 7.0.12 (upgrade to FortiProxy version 7.0.13 or later)
- FortiProxy version 2.0.0 to 2.0.13 (upgrade to FortiProxy version 2.0.14 or higher)
While there is no evidence that the above flaw has been actively exploited, unpatched Fortinet devices have been abused by threat actors multiple times, so users must act quickly to apply updates.
