Improper Input Validation in FortiClient for Linux Products
CVE-2021-22127

7.1HIGH

Key Information:

Vendor
Fortinet
Status
Fortinet Forticlientlinux
Vendor
CVE Published:
6 April 2022

Summary

An input validation issue in FortiClient for Linux allows unauthenticated attackers to potentially execute arbitrary code on the host operating system with root privileges. This vulnerability arises when a user connects to a network that has been maliciously named, thereby enabling threat actors to exploit this flaw. The affected versions include 6.4.x before 6.4.3 and 6.2.x before 6.2.9, emphasizing the need for prompt updates to ensure system security.

Affected Version(s)

Fortinet FortiClientLinux FortiClientLinux 6.4.2 and below, FortiClientLinux 6.2.8 and below

References

https://fortiguard.com/advisory/FG-IR-20-241
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.