/
← Voltar ao feed
critical

Public PoC released for critical FortiSIEM unauthenticated RCE flaw CVE-2026-106173 (CVSS 9.4) via gRPC path traversal

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 12:38 · coletado há 8 horas

Researchers at Horizon3.ai have published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM that lets an unauthenticated attacker achieve remote code execution through specially crafted packets. Fortinet patched the flaw last week. The public PoC lowers the barrier to exploitation for unpatched appliances. The article does not report in-the-wild exploitation.

Technical Details

  • The flaw is in the gRPC service listening on TCP port 27918. The QueryResultReq handler processes untrusted metadata without path validation.
  • SendQueryResult() builds a file path from the user-supplied query-id parameter without sufficient validation. This allows ../ directory traversal.
  • The application appends its own suffix, result-<source IP address>-0-0-<id>.dat, which would normally stop the attacker choosing the file name. Embedding a NUL byte (\0) in query-id truncates the path at the OS level and discards the suffix. The attacker then controls the exact target path.
  • Horizon3.ai demonstrated overwriting /opt/charting/redishb.sh, a Redis health-check shell script run every 60 seconds by a cron job. The overwrite keeps the original owner and permissions, which turns the arbitrary file write into RCE. A second variant uses two requests to create a brand-new file with an exact name.
  • Per Horizon3.ai, the traversal sequences and NUL-byte injection are crafted within gRPC's HTTP/2 and HPACK encoding layers.

Remediation

  • Upgrade FortiSIEM 7.5.0 to 7.5.1 or later.
  • FortiSIEM 7.6 is not affected.
  • Restrict network access to TCP port 27918 until patching is complete.

Linha do tempo

  1. thehackernews.com ↗ · pub. 20/10/2026 12:38 · coletado 20/10 14:00 primeiro registro

    Public PoC released for critical FortiSIEM unauthenticated RCE flaw CVE-2026-106173 (CVSS 9.4) via gRPC path traversal

    ler a análise desta fonte

    Researchers at Horizon3.ai have published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM that lets an unauthenticated attacker achieve remote code execution through specially crafted packets. Fortinet patched the flaw last week. The public PoC lowers the barrier to exploitation for unpatched appliances. The article does not report in-the-wild exploitation.

    Technical Details

    • The flaw is in the gRPC service listening on TCP port 27918. The QueryResultReq handler processes untrusted metadata without path validation.
    • SendQueryResult() builds a file path from the user-supplied query-id parameter without sufficient validation. This allows ../ directory traversal.
    • The application appends its own suffix, result-<source IP address>-0-0-<id>.dat, which would normally stop the attacker choosing the file name. Embedding a NUL byte (\0) in query-id truncates the path at the OS level and discards the suffix. The attacker then controls the exact target path.
    • Horizon3.ai demonstrated overwriting /opt/charting/redishb.sh, a Redis health-check shell script run every 60 seconds by a cron job. The overwrite keeps the original owner and permissions, which turns the arbitrary file write into RCE. A second variant uses two requests to create a brand-new file with an exact name.
    • Per Horizon3.ai, the traversal sequences and NUL-byte injection are crafted within gRPC's HTTP/2 and HPACK encoding layers.

    Remediation

    • Upgrade FortiSIEM 7.5.0 to 7.5.1 or later.
    • FortiSIEM 7.6 is not affected.
    • Restrict network access to TCP port 27918 until patching is complete.