CVE-2019-6692

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via forging that DLL.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	Fortinet FortiClient for Windows	FortiClient for Windows 6.2.0 and below

References

https://fortiguard.com/psirt/FG-IR-19-148Vendor Advisory
https://fortiguard.com/psirt/FG-IR-19-148Vendor Advisory

Timeline

Published: Oct 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-66936.5Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the CVE-2019-66959.8Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker t CVE-2019-66966.1An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to p CVE-2019-66976.1An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname param CVE-2019-66989.8Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge o CVE-2019-66995.4An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Sit CVE-2019-67006.5An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated CVE-2019-67025.9The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2 CVE-2019-67039.8Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauth CVE-2019-67067.5Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to tr CVE-2019-67077.2PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state product_id[] parameter.CVE-2019-67087.2PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter.