| CVE ID | CVE-2022-43946 |
| CVSS SCORE | 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| AFFECTED VENDORS |
Fortinet |
| AFFECTED PRODUCTS |
FortiClient VPN |
| VULNERABILITY DETAILS |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiClient VPN. Authentication is required to exploit this vulnerability. The specific flaw exists within the FortiClient Logging daemon. The product applies insufficient access controls to a sensitive pipe. A remote attacker can leverage this vulnerability to execute code in the context of SYSTEM. Additionally, a local attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. |
| ADDITIONAL DETAILS |
Fortinet has issued an update to correct this vulnerability. More details can be found at:
https://www.fortiguard.com/psirt/FG-IR-22-429 |
| DISCLOSURE TIMELINE |
|
| CREDIT | Ting |
