Fortinet FortiClientWindows up to 6.4.10/7.0.12/7.2.4/7.4.0 Named Pipe Message authentication bypass

Summaryinfo

A vulnerability classified as critical was found in Fortinet FortiClientWindows up to 6.4.10/7.0.12/7.2.4/7.4.0. This issue affects some unknown processing of the component Named Pipe Message Handler. Such manipulation leads to authentication bypass. This vulnerability is traded as CVE-2024-47574. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Fortinet FortiClientWindows up to 6.4.10/7.0.12/7.2.4/7.4.0. It has been rated as critical. Affected by this issue is an unknown function of the component Named Pipe Message Handler. The manipulation with an unknown input leads to a authentication bypass vulnerability. Using CWE to declare the problem leads to CWE-288. A product requires authentication, but the product has an alternate path or channel that does not require authentication. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages.

The advisory is available at fortiguard.fortinet.com. This vulnerability is handled as CVE-2024-47574 since 09/27/2024. The exploitation is known to be easy. Local access is required to approach this attack. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 210873 (Fortinet FortiClient Named Pipes Improper Access Control (FG-IR-24-199)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210873). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Fortinet

Name

• FortiClientWindows

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 7.0
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9
• 7.0.10
• 7.0.11
• 7.0.12
• 7.1
• 7.2
• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.3
• 7.4.0

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion