This vulnerability in Fortinet FortiSandbox involves exposure of resources to an incorrect security sphere, enabling unauthenticated network-based access to the VNC server of scanning VMs. Affected versions include 4.4.3 through 4.4.8 and 5.0.0 through 5.0.2. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity with network attack vector, no privileges required, and no user interaction needed. The vendor has released an official fix to remediate the issue.

Successful exploitation allows an unauthenticated attacker to gain access to the VNC server of virtual machines used for scanning, resulting in high confidentiality impact due to information disclosure, low integrity impact, and low availability impact. This could expose sensitive data processed or viewed within the sandbox environment.

An official fix is available from Fortinet to remediate this vulnerability. Users should apply the vendor-provided patches or upgrades to affected FortiSandbox versions 4.4.3 through 4.4.8 and 5.0.0 through 5.0.2 as soon as possible to prevent exploitation.