Privilege escalation in Fortinet Fortios
CVE-2017-14187
A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via linking the aforementioned binary program to a command that is allowed to be run by the fnsysctl CLI command.
Vulnerability class: Privilege Escalation
EPSS: 0.005 (37.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Fortinet Fortios
- Fortinet, Inc. Fortios — versions 5.2 and below versions, 5.4.0 to 5.4.8, 5.6.0 to 5.6.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@fortinet.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- psirt@fortinet.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@fortinet.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-14187?
- CVE-2017-14187 is a medium-severity vulnerability in Fortinet Fortios, classified under Improper Privilege Management. CVSS score: 6.2/10. Published 2018-05-24.
- How severe is CVE-2017-14187?
- Medium severity. CVSS v3 base score is 6.2 out of 10.
- Is CVE-2017-14187 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.