PT-2022-9229 · Fortinet · Forticlient

Published 2022-04-06 · Updated 2022-04-13 · CVE-2021-22127

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiClient for Linux versions 6.2.x through 6.2.8 FortiClient for Linux versions 6.4.x through 6.4.2

Description An improper input validation issue may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name.

Recommendations For FortiClient for Linux versions 6.2.x through 6.2.8, update to version 6.2.9 or later. For FortiClient for Linux versions 6.4.x through 6.4.2, update to version 6.4.3 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-22127

Affected Products

Forticlient

References · 4

• https://fortiguard.com/advisory/FG-IR-20-241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22127 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22127 · Vendor Advisory
• https://t.me/cibsecurity/40246 · Telegram Post