CVE-2023-33304: 
FortiClient vulnerability analysis and mitigation

A use of hard-coded credentials vulnerability was discovered in Fortinet FortiClient Windows versions 7.0.0 through 7.0.9 and 7.2.0 through 7.2.1. The vulnerability was initially published on November 14, 2023, and was assigned CVE-2023-33304. This security flaw allows an attacker to bypass system protections by exploiting static credentials (Fortinet Advisory).

The vulnerability is classified as CWE-798 (Use of Hard-coded Credentials) and received a CVSS v3.1 base score of 4.4 (Medium) from Fortinet, while NIST assigned it a score of 5.5 (Medium). The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, indicating that the vulnerability requires local access and high privileges but needs no user interaction to exploit (NVD).

The vulnerability allows attackers to bypass system protections through the use of static credentials, potentially compromising the security of affected systems. The impact primarily affects system integrity, with no direct effect on confidentiality or availability (Fortinet Advisory).

Fortinet has released patches to address this vulnerability. Users of FortiClient Windows 7.2.x should upgrade to version 7.2.2 or above, while users of FortiClient Windows 7.0.x should upgrade to version 7.0.10 or above (Fortinet Advisory).

The vulnerability was responsibly disclosed by Hanafiah Muhamad from One NZ, and Fortinet acknowledged their contribution to identifying this security issue (Fortinet Advisory).