Actively exploited in the wild
Fortinet FortiClient EMS SQL Injection Vulnerability
Fortinet - FortiClient EMS · Listed in the CISA KEV since 2024-03-25. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-48788
CriticalCVSS 9.8KEVSummary
In Fortinet FortiClientEMS versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10, an SQL injection vulnerability exists. Attackers can send specially crafted packets to execute unauthorized code or commands.
Risk Assessment
The risk includes execution of unauthorized commands on the EMS server, potentially leading to system integrity compromise or takeover.
Recommendation
Upgrade FortiClientEMS to a patched version.
Other vulnerabilities in Fortinet FortiClientEMS
See all- CVE-2026-39809Medium
Fortinet FortiClientEMS versions 7.4.0 through 7.4.5, 7.2.0 through 7.2.12, and 7.0 all versions contain an SQL injection vulnerability (improper neutralization of special elements in SQL commands). An attacker may execute unauthorized code or commands by sending crafted requests.
- CVE-2024-21753Medium
A path traversal vulnerability in Fortinet FortiClientEMS allows an attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests.
Original NVD description (English source)
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS