CVE-2023-45590CWE-94

An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows…

Critical · published April 9, 2024

CVSS v3.1
9.4
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

🚨 A single click on a malicious link could let attackers execute unauthorized commands on your system! 🔥 Think of this like a sneaky thief tricking you into opening your front door by pretending to be a delivery driver. Once they’re in, they can ransack your home while you’re none the wiser! This vulnerability could allow attackers to run any code they want on your device, potentially stealing sensitive data, altering settings, or even spreading malware—it's absolutely devastating! Imagine the chaos if your system becomes a tool in a cybercriminal's arsenal. This isn’t just a minor inconvenience; it could lead to serious breaches and loss of trust!

Put simply

Think of this like a sneaky thief tricking you into opening your front door by pretending to be a delivery driver. Once they’re in, they can ransack your home while you’re none the wiser! This code injection vulnerability in Fortinet FortiClient Linux versions 7.2.0, 7.0.6 through 7.0.10, and 7.0.3 through 7.0.4 arises from improper controls when generating code, allowing attackers to exploit users visiting malicious websites.

What to do

This vulnerability could allow attackers to run any code they want on your device, potentially stealing sensitive data, altering settings, or even spreading malware—it's absolutely devastating! Imagine the chaos if your system becomes a tool in a cybercriminal's arsenal. This isn’t just a minor inconvenience; it could lead to serious breaches and loss of trust! To protect yourself, immediately update FortiClient to version 7.0.11 or later. Additionally, educate your users about the risks of clicking on untrusted links, and consider implementing web filtering to block malicious sites. Don't wait; act now! You've got this! By taking these steps, you can secure your system and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
9.4 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X
CVSS v4.0
Not supplied
EPSS
0.01524 · 74.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-04-09T14:24Z
EPSS history
Timeline
  • 09 APR 14:24Z
    An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows…
    cvelistv5