← CVE Radar
CVE-2023-48788Fortinet FortiClient EMS SQL Injection Vulnerability
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
9.8 CRITICALEPSS 98.44%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.3 | CRITICAL | 3.1fortinet (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C |
CISA required action
⚡ Known exploited · remediation due Apr 15, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2023-48788
- Status
- Analyzed
- Assigner (CNA)
- fortinet
- Published
- Mar 12, 2024
- Last modified
- 2026-06-17 06:34 UTC
- Weaknesses
- CWE-89 · Execute unauthorized code or commands
Affected Products
As published by the CNA in the CVE record.
FortinetFortiClientEMS2 version ranges
- 7.2.0 through 7.2.2
- 7.0.1 through 7.0.10