Kernel Code Execution Vulnerability in FortiClient by Fortinet

CVE-2015-5736

Summary

The Fortishield.sys driver in Fortinet's FortiClient prior to version 5.2.4 contains vulnerabilities that allow local users to execute arbitrary code with kernel privileges. This is achieved by manipulating the callback function via specific ioctl calls, namely 0x220024 and 0x220028. Unauthorized access to kernel-level operations can lead to significant security risks and system compromise if exploited.

References