By NewsBlogger Fortinet addressed a critical vulnerability in its FortiClient EMS software, allowing attackers to remotely execute code on vulnerable servers, with the flaw impacting versions 7.0 and 7.2 and being discovered by the UK’s NCSC and developer Thiago Santana, prompting the release of a patch by Fortinet.
At a glance
- Fortinet addressed a critical vulnerability in its FortiClient EMS software.
- The vulnerability (CVE-2023-48788) allows remote code execution on vulnerable servers.
- Discovered by the UK’s NCSC and Fortinet developer Thiago Santana.
- Impacts FortiClient EMS versions 7.0 and 7.2 with an SQL injection flaw.
- Unauthenticated attackers can exploit the flaw to gain remote code execution with SYSTEM privileges.
The details
Fortinet recently addressed a critical vulnerability in its FortiClient Enterprise Management Server (EMS) software.
The vulnerability, known as CVE-2023-48788, allows attackers to execute code on vulnerable servers remotely.
FortiClient EMS is a platform for managing endpoints connected to an enterprise network.
The UK’s National Cyber Security Centre (NCSC) and Fortinet developer Thiago Santana discovered and reported the security flaw.
It impacts FortiClient EMS versions 7.0 and 7.2.
The vulnerability is specifically an SQL injection in the DB2 Administration Server (DAS) component.
Unauthenticated attackers can exploit this flaw to gain remote code execution with SYSTEM privileges on unpatched servers.
Notably, this vulnerability does not require any user interaction, making it particularly concerning.
Fortinet has released a patch to address this critical vulnerability.
However, the company has not disclosed whether the flaw had been actively exploited prior to patching.
Horizon3’s Attack Team has confirmed the critical severity of this bug.
In addition to this vulnerability, Fortinet also fixed another critical out-of-bounds write weakness (CVE-2023-42789) in the FortiOS and FortiProxy captive portal.
Furthermore, two other high-severity flaws were patched this week.
It is important to note that Fortinet disclosed a critical remote code execution (RCE) bug last month, which was confirmed to be actively exploited by the Cybersecurity and Infrastructure Security Agency (CISA). Fortinet’s software vulnerabilities are often targeted in ransomware attacks and cyber espionage campaigns.
For example, the Chinese Volt Typhoon hacking group has previously used FortiOS SSL VPN flaws to deploy malware on a military network affiliated with the Dutch Ministry of Defence.
Article X-ray
Sources
Here are all the sources used to create this article:
Facts attribution
This section links each of the article’s facts back to its original source.
If you suspect false information in the article, you can use this section to investigate where it came from.
| bleepingcomputer.com |
|---|
| – Fortinet patched a critical vulnerability in its FortiClient Enterprise Management Server (EMS) software – The vulnerability allows attackers to gain remote code execution on vulnerable servers – FortiClient EMS is used to manage endpoints connected to an enterprise network – The security flaw (CVE-2023-48788) is an SQL injection in the DB2 Administration Server (DAS) component – The vulnerability was discovered and reported by the UK’s National Cyber Security Centre (NCSC) and Fortinet developer Thiago Santana – It impacts FortiClient EMS versions 7.0 and 7.2 – Unauthenticated attackers can gain RCE with SYSTEM privileges on unpatched servers – The vulnerability does not require user interaction – Fortinet has not revealed if the vulnerability has been exploited before patching – Horizon3’s Attack Team confirmed the bug’s critical severity – Fortinet fixed another critical out-of-bounds write weakness (CVE-2023-42789) in FortiOS and FortiProxy captive portal – Two other high-severity flaws were patched this week – Fortinet disclosed a critical remote code execution (RCE) bug last month – CISA confirmed active exploitation of the RCE bug – Fortinet flaws are regularly exploited in ransomware attacks and cyber espionage campaigns – The Chinese Volt Typhoon hacking group used FortiOS SSL VPN flaws to deploy malware on a military network of the Dutch Ministry of Defence. |
