CVE-2022-43946: fortinet forticlient
Vulnerability summary
CVE-2022-43946 is a high (CVSS 8.1) vulnerability in fortinet forticlient. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.3% of scored vulnerabilities.
Timeline
- 11-04-2023PublishedVulnerability first disclosed.
- 23-10-2024Last modifiedVulnerability information updated.
Description
Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) race condition [CWE-367] vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute commands via writing data into a windows pipe.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA7.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:U/RC:CDiffers
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.70% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected systems
Fortinet2 products
- forticlient≥ 6.0.0, < 7.0.8
- forticlientwindows≥ 7.0.0, ≤ 7.0.7 | ≥ 6.4.0, ≤ 6.4.10 | ≥ 6.2.0, ≤ 6.2.9 | ≥ 6.0.0, ≤ 6.0.10
1 vendor · 2 products
References
1 links- fortiguard.com/psirt/FG-IR-22-429Vendor Advisory