Fortinet FortiClient Enterprise Management Server vulnerabilities

7 CVEs affecting Fortinet FortiClient Enterprise Management Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-33508, published 2024-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability, published 2024-03-12. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2024-03-25. EPSS: 98.4% chance of exploitation in the next 30 days. A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to…
CVE-2024-33508, published 2024-09-10. High severity, CVSS 7.3. EPSS: 1.3% chance of exploitation in the next 30 days. An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an…
CVE-2021-41030, published 2021-12-08. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated attacker to impersonate an existing…
CVE-2023-45581, published 2024-02-15. High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days. An improper privilege management vulnerability [CWE-269] in Fortinet FortiClientEMS version 7.2.0 through 7.2.2 and before 7.0.10 allows an Site administrator with Super Admin privileges to perform…
CVE-2020-15940, published 2021-11-02. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via…
CVE-2021-36189, published 2021-12-09. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to information disclosure via inspecting browser decrypted data
CVE-2021-32592, published 2021-12-01. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allow an attacker to perform a DLL Hijack…