CyberCVE

CVE-2024-47574

A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows lo

Severity
High 7.4
CVSS 3.1
Exploited
Not listed
EPSS
0.005
39.4th percentile
Discovered by
Third party
Vendor advisory field
Published
Nov 13, 2024
Assigned by fortinet

Description

A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages.

Weakness: CWE-288

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiClientWindows
  • fortinet · forticlientwindows

Credit

Fortinet is pleased to thank Nir Chako from Pentera for reporting this vulnerability under responsible disclosure

Vendor remediation

Please upgrade to FortiClientWindows version 7.4.1 or above Please upgrade to FortiClientWindows version 7.2.5 or above Please upgrade to FortiClientWindows version 7.0.13 or above

References

Something wrong here?