CVE-2019-16155

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process. Further more, FortiClient for Linux 6.2.2 and below allow low privilege user write the system backup file under root privilege through GUI thus can cause root system file overwrite.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Feb 7, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-161566.1An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may aCVE-2019-161576.5An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive informatiCVE-2019-161597.5BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8CVE-2019-16167.5A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a buCVE-2019-161607.5An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.CVE-2019-161617.5Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.CVE-2019-161627.5Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.CVE-2019-161637.5Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.CVE-2019-161646.5MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c.CVE-2019-161656.5GNU cflow through 1.6 has a use-after-free in the reference function in parser.c.CVE-2019-161666.5GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.CVE-2019-161675.5sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.