The vulnerability is an improper neutralization of special elements in SQL commands, enabling a classic SQL injection. Several FortiClientEMS releases, including those in the 7.4.x, 7.2.x, and 7.0 series, contain the flaw. An attacker who can send crafted requests to the affected EMS service may execute arbitrary SQL and potentially run unauthorized code or commands, compromising data integrity, confidentiality, and possibly gaining full system control.

The flaw affects Fortinet FortiClientEMS products across multiple major releases. Versions 7.4.0 through 7.4.5, 7.2.0 through 7.2.12, and all releases of the 7.0 line are vulnerable. The CPE entries list specific 7.4.x variants up to 7.4.4, confirming these as affected. Administrators should identify whether their infrastructure runs any of these versions.

The CVSS base score is 6.2, placing the risk in the medium range, and the EPSS score is not available, making precise exploitation probability hard to assess. The vulnerability is not currently in CISA’s KEV catalog. Given that the flaw requires sending malformed SQL payloads over a network interface, the likely attack vector is remote over the EMS service’s exposed ports. Attackers could invoke the vulnerability without authentication if the EMS is reachable externally, making remediation urgent.