CVE-2023-48788 is a critical SQL injection vulnerability affecting Fortinet FortiClientEMS versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10. This flaw allows unauthenticated attackers to execute arbitrary code or commands remotely via specially crafted packets. With a CVSS score of 9.8 (Critical) and an EPSS score indicating extremely high exploitability, the impact includes complete compromise of confidentiality, integrity, and availability. The vulnerability is actively exploited in the wild, including in known ransomware campaigns, with public exploit modules available in Metasploit and Nuclei, and has garnered significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 7.0.1, <= 7.0.10CPE match | cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:* | ||
>= 7.2.0, <= 7.2.2CPE match | cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:* | ||
>= 7.0.1, < 7.0.11CPE matchmatch criteria | cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:* | ||
>= 7.2.0, < 7.2.3CPE matchmatch criteria | cpe:2.3:a:fortinet:forticlient_enterprise_management_server:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.