PSIRTProtection may be disabled by local attacker
Summary
An improper access control vulnerabilty [CWE-284] in FortiEDRCollectorWindows may allow a local attacker to prevent the collector service to start in the next system reboot by tampering with some registry keys of the service.
Affected Products
FortiEDRCollectorWindows version 5.2.0.4549 and below
FortiEDRCollectorWindows 5.0.3.1007 and below
FortiEDRCollectorWindows 4.0 all versions
Solutions
Please upgrade to FortiEDRCollectorWindows version 5.2.0.4581 or above
Please upgrade to FortiEDRCollectorWindows version 5.0.3.1016 or above
Timeline
2023-11-07: Initial publication