Fortinet, a cybersecurity company headquartered in Sunnyvale, California develops and sells cybersecurity solutions, such as physical firewalls, antivirus software, intrusion prevention systems, and endpoint security components.
Recently, the company has issued security fixes for the multiple products that affect its various endpoint security products.
The flaws which are rated high in severity include Path traversal vulnerability tracked as (CVE-2022-30302) in the FortiDeceptor management interface that allows a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests.
The Fortinet advisory mentions the following affected products:
Patch Released:
A high severity flaw was tracked as (CVE-2021-41031) in FortiClient (Windows), which allows a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service.
The affected products include:
Patch Released:
A vulnerability tracked as (CVE-2021-43072), rated as high severity found in FortiAnalyzer, FortiManager, FortiOS, and FortiProxy. On the successful exploitation, it allows an attacker to execute arbitrary code or command via crafted CLI ‘execute restore image’ and ‘execute certificate remote’ operations with the TFTP protocol.
The Affected Products include:
Patch Released:
An empty password in configuration file vulnerability tracked as (CVE-2022-26117) rated high severity, through which an attacker could access the MySQL databases via the command line interface.
The Affected Products include:
Patch Released
Therefore, Fortinet addressed as many as four high-severity vulnerabilities affecting FortiAnalyzer, FortiClient, FortiDeceptor, and FortiNAC.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
The Sekoia TDR (Threat Detection & Research) team has reported on a sophisticated network infrastructure…
The Socket Threat Research Team has unearthed a trio of malicious packages, two hosted on…
Hackers are now exploiting a legitimate Microsoft utility, mavinject.exe, to inject malicious DLLs into unsuspecting…
Small and midsized businesses (SMBs) continue to be prime targets for cybercriminals, with network edge…
Joining Criminal IP at Booth S-634 | South Expo, Moscone Center | April 28 –…
Cybersecurity researchers have uncovered critical SQL injection vulnerabilities in four TP-Link router models, enabling attackers…
.jpeg?w=1024&resize=1024,682&ssl=1)
