Fortinet FortiSIEM (versions 7.5.0 and below)

The flaw lives inside a function called SendQueryResult(), which accepts a user-supplied query-id parameter and passes it directly into a file path without validating it. Two weaknesses combine: directory traversal sequences (../) let an attacker escape the intended folder, and a null byte (\0) injected into the parameter causes the operating system to ignore everything that follows it, allowing the attacker to choose the exact filename to overwrite.

An unauthenticated attacker connects to the gRPC service (a framework for communication between services) on TCP port 27918. By crafting a query-id value containing traversal sequences and a null byte, they can overwrite a shell script (redishb.sh) that runs automatically every 60 seconds via a scheduled task. Replacing that script with malicious code gives the attacker remote code execution (the ability to run any command on the target server) with no login required.

1. Check logs on port 27918 for unexpected external connections or unusual gRPC traffic.
2. Monitor redishb.sh and surrounding files in /opt/charting/ for unexpected modifications or timestamp changes.
3. Look for anomalous cron job activity or unexpected outbound connections from the FortiSIEM host.

1. Upgrade FortiSIEM 7.5.0 to version 7.5.1 or above immediately.
2. Restrict access to TCP port 27918 at the network perimeter — this service should not be reachable from untrusted networks.
3. Review recent file modification logs on affected systems to check whether exploitation has already occurred.