Medium · published March 7, 2023
CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 95.8th percentile for exploit probability.
⚠️ Just a couple of crafty commands can let a privileged attacker under the hood of your Fortinet system! Think of this as a delivery driver who can sneak past the security gate, not just to drop off packages but also to rummage through your warehouse — unauthorized access to critical files! An attacker with the right privileges could read sensitive files or even modify system configurations, potentially leading to data leaks or system misconfigurations. This isn't a full-blown disaster, but it could definitely cause some serious headaches!
Think of this as a delivery driver who can sneak past the security gate, not just to drop off packages but also to rummage through your warehouse — unauthorized access to critical files! This path traversal vulnerability in FortiOS allows attackers to bypass directory restrictions through crafted CLI commands, enabling them to read and write files on the underlying Linux system.
An attacker with the right privileges could read sensitive files or even modify system configurations, potentially leading to data leaks or system misconfigurations. This isn't a full-blown disaster, but it could definitely cause some serious headaches! To secure your system, patch to Fortinet FortiOS version 7.2.4 or later, 7.0.10, or 6.4.11. Regularly review and restrict privileged user access to minimize potential risks! You've got this! Follow these steps, and your system will be fortified in no time! 🛡️