CVE-2020-9290

Description

An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.049

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2020-9290 are affected in Forticlient 6.2.3	Windows
Vulnerabilities CVE-2020-9290 are affected in forticlient_virtual_private_network 6.2.3	NCM
Uncontrolled Search Path Element Vulnerability (CVE-2020-9290)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234