CVE-2022-43946

Published Apr 11, 2023 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Description

Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) race condition [CWE-367] vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute commands via writing data into a windows pipe.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Fortinet

FortiClientWindows

unaffected

Version	Status	Constraints
`7.0.0`	affected	≤ 7.0.7
`6.4.0`	affected	≤ 6.4.10
`6.2.0`	affected	≤ 6.2.9
`6.0.0`	affected	≤ 6.0.10

Configuration 1 [-]

cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*

No data.

No data available yet.

Remediation

Vendor Solution

Please upgrade to FortiClientWindows version 7.2.0 or above Please upgrade to FortiClientWindows version 7.0.8 or above

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2022-46916	Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) race condition [CWE-367] vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute commands via writing data into a windows pipe.