usb drive + root credentials + fnsysctl tool can gain arbitrary code execution. Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-17-245 Final 1 1 2018-05-18T00:00:00 Current version 2018-05-18T00:00:00 2018-05-18T00:00:00 An admin user with super_admin privileges can execute an arbitrary binary contained on an USB drive plugged to a FortiGate, via linking the aforementioned binary to a command that is allowed to be run by the fnsysctl CLI command. Execute unauthorized code or commands FortiOS 5.6.0 to 5.6.2FortiOS 5.4.0 to 5.4.8FortiOS 5.2 and below. Upgrade to 5.6.3 or 5.4.9 or newer versions Workarounds: * Switching to FIPS mode will ban the fnsysctl CLI command hence preventing the attack. * Only the super_admin profile has the privileges required to perform the attack, so avoid assigning it to administrators. Fortinet is pleased to thank Shaanan Cohney of University of Pennsylvania for reporting this vulnerability under responsible disclosure. CVE-2017-14187 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X https://fortiguard.fortinet.com/psirt/FG-IR-17-245 usb drive + root credentials + fnsysctl tool can gain arbitrary code execution. Reference>