FortiClient CVE-2019-5589

Exploitation requires the attacker to control the directory in which FortiClientOnlineInstaller.exe is located and to place a malicious .dll there, AND requires the victim to execute the online installer from that directory (UI:R). It affects only the FortiClient Online Installer on Windows at versions before 6.0.6 - the full MSI/offline installer and patched 6.0.6+ builds are not in scope. Key limiting factors: the attacker needs prior write access to the installer's folder (not a default remote-exploitable condition), user interaction is mandatory to launch the installer, and code runs only at the privilege level of the user who runs it. These constraints make exploitation realistic mainly where installers are run from shared, removable, or attacker-writable locations rather than against default standalone deployments.

Conflicting signals dominate this assessment and must be reconciled. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) scores 8.8 'High' and implies network-reachable, unauthenticated code execution, but the description makes clear this is a classic DLL search-path hijack (CWE-426) that requires the attacker to already control the directory in which FortiClientOnlineInstaller.exe resides. That precondition is substantial and is not well represented by AV:N - it is closer to local/adjacent access (e.g., writable Downloads folder, shared drive, or attacker-staged UNC path), so the headline 8.8 likely overstates real-world remote risk. Supporting signals are moderate-to-low: EPSS is 2.61% (84th percentile), indicating above-median but not high predicted exploitation; there is no CISA KEV listing and no public exploit identified, so there is no evidence of active or widespread exploitation. CWE-426 DLL planting is well understood and trivially weaponizable once the directory precondition is met (no SSVC/automatable data was supplied, but technical impact is total - C:H/I:H/A:H). Net judgment: this is a genuine code-execution bug meriting patching, but it is a configuration/delivery-dependent issue rather than a drive-by remote RCE; prioritize it as medium-priority unless FortiClient installers are routinely executed from shared or attacker-writable locations. Conflict to verify with vendor: CVSS AV:N versus description implying attacker-controlled-directory (local/adjacent) access.

An attacker stages a malicious DLL (e.g., one of the libraries the installer loads by name) in the same directory as FortiClientOnlineInstaller.exe - for example a shared network folder, a USB drive, or a user's Downloads directory the attacker can write to. When a victim runs the online installer from that directory, the unsafe search path causes the planted DLL to load, executing attacker code with the user's privileges. No public exploit is identified at time of analysis, but DLL-hijack payloads are trivial to produce.