CVE-2019-16152

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root privilege crashes via sending specially crafted IPC client requests to the fctsched process due the nanomsg not been correctly validated.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Fortinet	Fortinet FortiClientLinux	FortiClientLinux 6.2.1 and below

References

https://danishcyberdefence.dk/blog/forticlient_linuxExploit, Third Party Advisory
https://fortiguard.com/psirt/FG-IR-19-238Vendor Advisory
https://danishcyberdefence.dk/blog/forticlient_linuxExploit, Third Party Advisory
https://fortiguard.com/psirt/FG-IR-19-238Vendor Advisory

Timeline

Published: Feb 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-161539.8A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the d CVE-2019-161546.1An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perfo CVE-2019-161557.1A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files CVE-2019-161566.1An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may a CVE-2019-161576.5An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive informati CVE-2019-161597.5BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8 CVE-2019-16167.5A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a bu CVE-2019-161607.5An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.CVE-2019-161617.5Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.CVE-2019-161627.5Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.CVE-2019-161637.5Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.CVE-2019-161646.5MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c.