Fortinet FortiOS < 7.2.0 — Path Traversal

A local attacker, with administrative privileges, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2023-04-04 under CISA BOD 22-01.

This is a Path Traversal (CWE-22) vulnerability in Fortinet FortiOS. A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands. Exploitation requires local access, low attack complexity, an administrative account, and no user interaction required.

Probably yes if any of these apply:

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2023-03-14 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2023-04-04.