CVE-2019-16155 - A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process

Back Back to CVE browser

HIGH

A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process

Published Feb 7, 2020

7.1

HIGH

CVSS 3.1

EPSS 0.44%

Description

A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process. Further more, FortiClient for Linux 6.2.2 and below allow low privilege user write the system backup file under root privilege through GUI thus can cause root system file overwrite.

Affected products

Vendor Fortinet Product Fortinet FortiClientLinux Default
n/a
- Version
  FortiClientLinux 6.2.1 and below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fortinet

Fortinet FortiClientLinux

n/a

Version	Status	Constraints
FortiClientLinux 6.2.1 and below	affected	-

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://danishcyberdefence.dk/blog/forticlient_linux
x_refsource_MISCExploitThird Party Advisory
https://fortiguard.com/psirt/FG-IR-19-238
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://danishcyberdefence.dk/blog/forticlient_linux		x_refsource_MISCExploitThird Party Advisory
https://fortiguard.com/psirt/FG-IR-19-238		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner fortinet

Published Feb 7, 2020

Updated Oct 25, 2024

Reserved Sep 9, 2019

Link CVE-2019-16155

CISA Vulnrichment

Updated Oct 23, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-16155

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-16155