Fortinet has alerted users to a severe vulnerability in FortiClientEMS, enabling potential attacker-driven code execution.
This SQL Injection flaw, identified as CVE-2023-48788 with a 9.3 CVSS score, affects FortiClientEMS versions 7.2.0 to 7.2.2 and 7.0.1 to 7.0.10; users should upgrade to safer versions. Credits for the discovery go to Thiago Santana and the U.K.’s NCSC.
Additionally, critical vulnerabilities in FortiOS and FortiProxy (CVE-2023-42789 and CVE-2023-42790, both rated 9.3) could allow attackers to run arbitrary code through malformed HTTP requests, affecting various versions with specified upgrade paths.
Despite no current exploitation reports, Fortinet emphasizes prompt patching due to past abuses of unpatched systems.
