CVE-2017-14187

Severity: medium (CVSS 6.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-24 · updated 2026-06-17
Weakness: CWE-269

Description

A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via linking the aforementioned binary program to a command that is allowed to be run by the fnsysctl CLI command.

Affected products

Fortinet FortiOS (FortiGate): through 5.2.0; from 5.4.0 through 5.4.8; from 5.6.0 through 5.6.2

References

http://www.securityfocus.com/bid/104312
http://www.securitytracker.com/id/1040983
https://fortiguard.com/advisory/FG-IR-17-245
http://www.securityfocus.com/bid/104312
http://www.securitytracker.com/id/1040983
https://fortiguard.com/advisory/FG-IR-17-245

Get alerted when CVE-2017-14187 or the next vulnerability affects your stack