TL;DR

['Local attackers can exploit this flaw to escalate privileges on affected Fortinet FortiClient installations via the FCConfig utility, rated CVSS 7.8 by ZDI.']

What happened

["A local privilege escalation vulnerability was identified in Fortinet's FortiClient FCConfig utility."]

Why it matters for ops

['The exploit enables attackers with low-privileged user access to escalate their privileges on the system.', 'This can lead to unauthorized access and control over affected systems, potentially compromising data integrity and security.']

Mitigation

  • Apply available patches for the affected versions of FortiClient as soon as possible.
  • Monitor system logs for any unauthorized privilege escalation attempts.

Action items

  • Update to non-vulnerable version immediately if patch is available.
  • Review and enhance security policies around least privilege access principles.

Detection IOCs

  • Unusual file writes or modifications by low-privileged processes
  • Unexpected network connections initiated by FCConfig utility

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-115/