PT-2025-6260 · Fortinet · Forticlient

CVE-2024-40586 · Publicado 2025-02-11 · Atualizado 2025-07-16

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: FortiClient versions 7.4.0 through 7.0.13 and earlier

Description: The issue is related to improper access control, which may allow a local user to escalate their privileges via the FortiSSLVPNd service pipe. This could potentially be exploited by an attacker to gain elevated access.

Recommendations: For FortiClient versions 7.4.0 and earlier, consider restricting access to the FortiSSLVPNd service pipe as a temporary workaround until a patch is available. For versions 7.2.6 and below, as well as version 7.0.13 and below, apply the same restriction to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2025-01613

CVE-2024-40586

Produtos afetados

Forticlient

Referências · 7

• https://fortiguard.fortinet.com/psirt/FG-IR-23-279 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1889355105733861744 · Publicação no Twitter
• https://t.me/cvedetector/17730 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2024-40586 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-40586 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-01613 · Nota de Segurança
• https://t.me/cvenotify/129179 · Publicação no Telegram