CVE-2023-48788

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - psirt@fortinet.com

Published

2024-03-12

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2024-03-25, action due 2024-04-15: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-89

Affected products

• Forticlient Enterprise Management Server (Fortinet)
• Forticlientems (Fortinet)

References

• https://fortiguard.com/psirt/FG-IR-24-007
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48788