Fortinet Addresses Unpatched Critical RCE Vector

Share:

NEWS BRIEF

Fortinet has finally patched a critical security vulnerability in its Wireless LAN Manager (FortiWLM) that could allow unauthenticated sensitive information disclosure. And, when chained with another issue, it could lead to remote code execution (RCE), a researcher warned.

The bug (CVE-2023-34990, CVSS 9.6) was first disclosed in March, when it was described as an “unauthenticated limited file read vulnerability” without a CVE.

“This issue results from the lack of input validation on request parameters allowing an attacker to traverse directories and read any log file on the system,” Horizon3.ai security researcher Zach Hanley, who reported the bug to Fortinet, noted in March. He has confirmed to Dark Reading that the bug patched this week is the same issue.

He added, “Luckily for an attacker, the FortiWLM has very verbose logs — and logs the session ID of all authenticated users. Abusing the above arbitrary log file read, an attacker can now obtain the session ID of a user and login and also abuse authenticated endpoints.”

NIST’s National Vulnerability Database (NVD) has noted that the flaw can also be used to “execute unauthorized code or commands via specially crafted Web requests” — thanks to the access it provides to those authenticated endpoints.

The bug affects FortiWLM versions 8.6.0 through 8.6.5 (fixed in 8.6.6 or above) and versions 8.5.0 through 8.5.4 (fixed in 8.5.5 or above).

Combining Fortinet Vulnerabilities to Achieve RCE

Hanley back in March flagged a potential exploit chain as well: When CVE-2023-34990 is combined with an authenticated command-injection bug that Fortinet patched last year (CVE-2023-48782, CVSS 8.8), it becomes another recipe for RCE.

This second issue allows an attacker who has used CVE-2023-34990 to gain access to an authenticated endpoint to, from there, inject a crafted malicious string in a request to the /ems/cgi-bin/ezrf_switches.cgi endpoint that will be executed with root privileges.

“Combining both the unauthenticated arbitrary log file read and this authenticated command injection, an unauthenticated attacker can obtain remote code execution in the context of root,” Hanley explained. “This endpoint is accessible for both low privilege users and admins.”

Tara Seals

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
5:49 pm, Feb 15, 2025
weather icon 4°C
L: 4° | H: 5°
light rain
Humidity: 85 %
Pressure: 1020 mb
Wind: 10 mph E
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0.28 mm
Clouds: 75%
Rain Chance: 0%
Visibility: 9 km
Sunrise: 7:14 am
Sunset: 5:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
4° | 5°°C 1 mm 100% 6 mph 88 % 1020 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
2° | 5°°C 0.79 mm 79% 9 mph 95 % 1022 mb 0 mm/h
Mon Feb 17 9:00 pm
weather icon
1° | 7°°C 0 mm 0% 7 mph 77 % 1022 mb 0 mm/h
Tue Feb 18 9:00 pm
weather icon
3° | 9°°C 0 mm 0% 9 mph 73 % 1021 mb 0 mm/h
Wed Feb 19 9:00 pm
weather icon
5° | 11°°C 0 mm 0% 8 mph 94 % 1019 mb 0 mm/h
Today 6:00 pm
weather icon
3° | 4°°C 1 mm 100% 6 mph 85 % 1020 mb 0 mm/h
Today 9:00 pm
weather icon
2° | 4°°C 1 mm 100% 6 mph 88 % 1020 mb 0 mm/h
Tomorrow 12:00 am
weather icon
2° | 3°°C 0.79 mm 79% 6 mph 91 % 1020 mb 0 mm/h
Tomorrow 3:00 am
weather icon
2° | 2°°C 0 mm 0% 5 mph 95 % 1020 mb 0 mm/h
Tomorrow 6:00 am
weather icon
3° | 3°°C 0 mm 0% 7 mph 88 % 1020 mb 0 mm/h
Tomorrow 9:00 am
weather icon
3° | 3°°C 0 mm 0% 7 mph 85 % 1021 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
5° | 5°°C 0 mm 0% 9 mph 65 % 1021 mb 0 mm/h
Tomorrow 3:00 pm
weather icon
5° | 5°°C 0 mm 0% 8 mph 62 % 1021 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,786.40
-1.04%
Ethereum(ETH)
€2,556.61
-3.26%
XRP(XRP)
€2.62
-0.19%
Tether(USDT)
€0.95
0.00%
Solana(SOL)
€184.60
-5.41%
USDC(USDC)
€0.95
0.01%
Dogecoin(DOGE)
€0.258930
-4.46%
Shiba Inu(SHIB)
€0.000015
-4.53%
Pepe(PEPE)
€0.000010
-7.13%
Scroll to Top