Fortinet has issued a serious warning about a Remote Code Execution (RCE) vulnerability in its FortiClient Enterprise Management Server (EMS) software. This threat could let cyber attackers run harmful codes on vulnerable servers from afar.
Recognised as CVE-2021-38553, this critical flaw is rated 9.8/10 using the Common Vulnerability Scoring System (CVSS). It represents a significant risk, potentially leaving sensitive data open to burglary or manipulation. Fortinet recommends prompt software updates to the newest version to remediate this threat and enhance system security.
The main use of the EMS software is to grant system administrators control over endpoint connections in a business network, disseminating FortiClient software, and allocating security profiles across Windows systems. Its vast capabilities, from managing firewall rules to deploying antivirus applications, reinforce system integrity and protect against potential security threats.
The identified vulnerability originates from an SQL injection in the DB2 Administration Server (DAS) unit, discovered by the UK’s National Cyber Security Centre (NCSC) and Fortinet developer Thiago Santana. Affected EMS versions include 7.0.1 to 7.0.10 and 7.2.0 to 7.2.2. The SQL injection vulnerability is a major threat, enabling hackers to insert malicious code and possibly compromise sensitive data.
Companies using the threatened EMS versions should urgently address this issue. Organizations should instantly update their EMS software to the most recent patched version or, at a minimum, apply workarounds to lower the risk.
This vulnerability could allow unauthorized users to activate RCE with SYSTEM rights without user interaction on servers that are not adequately patched. The SQL Injection flaw in FortiClientEMS enables an attacker to run unauthorized code using carefully devised requests, posing a severe threat.
As yet, Fortinet has not reported if the vulnerability has been exploited prior to the patch being implemented. It also remains unknown whether any attacks exploiting this vulnerability occurred before the patch was introduced. It’s worth noting that Horizon3, an organization that identifies security threats, plans to release a proof-of-concept exploit code and an in-depth technical analysis.
Additionally, Fortinet has rectified an out-of-bounds write vulnerability in its FortiOS and FortiProxy captive portals and two other major flaws in FortiWLM MEA for FortiManager and FortiClient EMS. These recent breaches serve as a stark reminder for organizations to continually update their systems with the latest patches and security updates. With the rise in cyber threats, the importance of cybersecurity cannot be underestimated.
