CVE-2024-35282
A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions ma
Severity
Low 3.9
CVSS 3.1
Exploited
Not listed
EPSS
0.002
6.0th percentile
Discovered by
Third party
Vendor advisory field
Published
Sep 10, 2024
Assigned by fortinet
Description
A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an unauthenticated attacker that has physical access to a jailbroken device to obtain cleartext passwords via keychain dump.
Weakness: CWE-316
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiClientiOS
Credit
Fortinet is pleased to thank Sanjeev Sinha, formerly of Walmart Global Tech for bringing this issue to our attention under responsible disclosure.
Vendor remediation
Upgrade to FortiClientiOS version 7.4.0 or above