CVE-2023-45590

The vulnerability results from improper code generation control (CWE-94) in the FortiClientLinux application. An attacker prepares a malicious website and then persuades a FortiClientLinux user to visit it. The interaction of the client application with the content of this website leads to the execution of untrusted code in the context of the FortiClientLinux process. The attack is possible remotely without requiring privileges on the attacker's side, with minimal user interaction.

An attacker can execute arbitrary code or commands on the victim's system, which may lead to complete host compromise, disclosure of sensitive data, and violation of system integrity and availability.

FortiClientLinux should be updated to a version without the vulnerability in accordance with the manufacturer's recommendations published at https://fortiguard.com/psirt/FG-IR-23-087. Until the update is applied, internet browsing capabilities should be restricted for users running vulnerable client versions and they should be made aware of the risks of visiting unknown websites.

Fortinet FortiClientLinux in versions: 7.2.0, 7.0.6 to 7.0.10, and 7.0.3 to 7.0.4