Unsafe Search Path vulnerability in FortiClient for Windows by Fortinet
CVE-2020-9290

7.8HIGH

Key Information:

Vendor

Fortinet
Status
Fortinet Forticlient For Windows
Vendor
CVE Published:
15 March 2020

What is CVE-2020-9290?

An Unsafe Search Path vulnerability exists in the FortiClient for Windows online installer, where a local attacker can leverage control over the installer directory to execute arbitrary code. By placing malicious Filter Library DLL files in the directory where the FortiClient installers reside (FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe), an attacker can compromise the system, leading to potential data breaches and system instability.

Affected Version(s)

Fortinet FortiClient for Windows 6.2.3 and below

References

https://fortiguard.com/psirt/FG-IR-19-060
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.