Main Vulnerability Database Vulnerabilities #VU48748

Protection Mechanism Failure in Fortinet, Inc products - CVE-2020-9295

Published: December 2, 2020

Vulnerability identifier: #VU48748

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9295

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the affected software may not immediately detect certain types of malformed or non-standard RAR archives, potentially containing malicious files. An attacker can bypass implemented security restrictions and elevate privileges on the system.

Affected software

AV engine
FortiOS
Fortinet FortiClient for Windows

How to mitigate CVE-2020-9295

Install updates from vendor's website.

AV engine - addressed in versions 6.00145, 6.00243

External References

https://fortiguard.com/psirt/FG-IR-20-037

Related Security Bulletins