PT-2025-20901 · Fortinet · Forticlientmac+1

Published 2025-05-13 · Updated 2026-02-05 · CVE-2024-35281

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: FortiClientMac versions 7.0 through 7.4.2 FortiClientMac versions 7.0 through 7.2.8 FortiVoiceUCDesktop version 3.0

Description: An improper isolation or compartmentalization issue may allow an authenticated attacker to inject code via Electron environment variables.

Recommendations: For FortiClientMac versions 7.0 through 7.4.2, consider restricting access to the Electron environment variables as a temporary workaround until a patch is available. For FortiClientMac versions 7.0 through 7.2.8, consider restricting access to the Electron environment variables as a temporary workaround until a patch is available. For FortiVoiceUCDesktop version 3.0, consider restricting access to the Electron environment variables as a temporary workaround until a patch is available.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

BDU:2025-11226

CVE-2024-35281

Affected Products

Forticlientmac

Fortivoiceucdesktop

References · 10

• https://osv.dev/vulnerability/CVE-2024-35281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35281 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-025 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11226 · Security Note
• https://vuldb.com/?id.308639 · Note
• https://t.me/cveNotify/150987 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2025051365 · Note
• https://t.me/cveNotify/143339 · Telegram Post
• https://twitter.com/CVEnew/status/1922310005526540677 · Twitter Post
• https://t.me/cvetracker/23739 · Telegram Post