What is CVE-2020-9290?

CVE-2020-9290 is a high-severity vulnerability in Fortinet Forticlient, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2020-03-15.

How severe is CVE-2020-9290?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Fortinet Forticlient

CVE-2020-9290

An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.

EPSS: 0.006 (45.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Fortinet Forticlient
Fortinet Forticlient_virtual_private_network
Fortinet Forticlient For Windows — versions 6.2.3 and below

Weakness classification (CWE)

CWE-427 — Uncontrolled Search Path Element

References

psirt@fortinet.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2020-9290?: CVE-2020-9290 is a high-severity vulnerability in Fortinet Forticlient, classified under Uncontrolled Search Path Element. CVSS score: 7.8/10. Published 2020-03-15.
How severe is CVE-2020-9290?: High severity. CVSS v3 base score is 7.8 out of 10.