CyberCVE

CVE-2024-36507

A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social

Severity
Medium 6.7
CVSS 3.1
Exploited
Not listed
EPSS
0.003
20.8th percentile
Discovered by
Third party
Vendor advisory field
Published
Nov 12, 2024
Assigned by fortinet

Description

A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering.

Weakness: CWE-426

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiClientWindows
  • fortinet · forticlientwindows

Credit

Fortinet is pleased to thank Aleksandar Marceta-Pavlovic from WKO Inhouse GmbH of the Austrian Economic Chambers for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiClientWindows version 7.4.1 or above Please upgrade to FortiClientWindows version 7.2.5 or above Please upgrade to FortiClientWindows version 7.0.13 or above

References

Something wrong here?