Fortinet has launched patches to deal with a vital security flaw impacting FortiClientLinux that may very well be exploited to attain arbitrary code execution.
Tracked as CVE-2023-45590, the vulnerability carries a CVSS rating of 9.4 out of a most of 10.
“An Improper Management of Technology of Code (‘Code Injection’) vulnerability [CWE-94] in FortiClientLinux might enable an unauthenticated attacker to execute arbitrary code by way of tricking a FortiClientLinux person into visiting a malicious web site,” Fortinet stated in an advisory.

The shortcoming, which has been described as a case of distant code execution on account of a “harmful nodejs configuration,” impacts the next variations –
- FortiClientLinux variations 7.0.3 by means of 7.0.4 and seven.0.6 by means of 7.0.10 (Improve to 7.0.11 or above)
- FortiClientLinux model 7.2.0 (Improve to 7.2.1 or above)
Safety researcher CataLpa from Dbappsecurity has been credited with discovering and reporting the vulnerability.
Fortinet’s security patches for April 2024 additionally deal with a difficulty with FortiClientMac installer that would additionally result in code execution (CVE-2023-45588 and CVE-2024-31492, CVSS scores: 7.8).
Additionally resolved is a FortiOS and FortiProxy bug that would leak administrator cookies in sure eventualities (CVE-2023-41677, CVSS rating: 7.5).
Whereas there isn’t a proof of any of the issues being exploited within the wild, it is really helpful that customers preserve their programs up-to-date to mitigate potential threats.