CVE-2024-40592
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a
Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.001
3.2th percentile
Discovered by
Not disclosed
Published
Nov 12, 2024
Assigned by fortinet
Description
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.
Weakness: CWE-347
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported affected versions (2)
- Fortinet · FortiClientMac
- fortinet · forticlientmac
Vendor remediation
Please upgrade to FortiClientMac version 7.4.1 or above Please upgrade to FortiClientMac version 7.2.5 or above