CVE-2009-1262 : Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlie

Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format string specifiers in the VPN connection name.

Published 2009-04-07 23:30:00

Updated 2025-04-09 00:30:58

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2009-1262

Fortinet » Forticlient » Version: 3.0.614
cpe:2.3:h:fortinet:forticlient:3.0.614:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-1262

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 20 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-1262

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1262

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1262

Jump to

Vulnerability Details : CVE-2009-1262

Products affected by CVE-2009-1262

Exploit prediction scoring system (EPSS) score for CVE-2009-1262

CVSS scores for CVE-2009-1262

CWE ids for CVE-2009-1262

References for CVE-2009-1262