CVE-2009-1262

high

Description

Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/49633

http://www.vupen.com/english/advisories/2009/0941

http://www.securitytracker.com/id?1021966

http://www.securityfocus.com/bid/34343

http://www.securityfocus.com/archive/1/502602/100/0/threaded

http://www.securityfocus.com/archive/1/502354/100/0/threaded

http://www.layereddefense.com/FortiClient02Apr.html

http://secunia.com/advisories/34524

http://osvdb.org/53266

http://lists.grok.org.uk/pipermail/full-disclosure/2009-April/068583.html

Details

Source: Mitre, NVD

Published: 2009-04-07

Updated: 2025-04-09

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H