CVE-2024-36506
An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all versions may allow a remote attacker to by
Severity
Low 3.5
CVSS 3.1
Exploited
Not listed
EPSS
0.005
39.8th percentile
Discovered by
Not disclosed
Published
Jan 14, 2025
Assigned by fortinet
Description
An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all versions may allow a remote attacker to bypass the trusted host feature via session connection.
Weakness: CWE-940
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiClientEMS
Vendor remediation
Please upgrade to FortiClientEMS version 7.4.1 or above Please upgrade to FortiClientEMS version 7.2.5 or above Please upgrade to FortiSASE version 24.2.c or above