PT-2025-6260 · Fortinet · Forticlient

Published 2025-02-11 · Updated 2025-07-16 · CVE-2024-40586

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: FortiClient versions 7.4.0 through 7.0.13 and earlier

Description: The issue is related to improper access control, which may allow a local user to escalate their privileges via the FortiSSLVPNd service pipe. This could potentially be exploited by an attacker to gain elevated access.

Recommendations: For FortiClient versions 7.4.0 and earlier, consider restricting access to the FortiSSLVPNd service pipe as a temporary workaround until a patch is available. For versions 7.2.6 and below, as well as version 7.0.13 and below, apply the same restriction to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-01613

CVE-2024-40586

Affected Products

Forticlient

References · 7

• https://fortiguard.fortinet.com/psirt/FG-IR-23-279 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40586 · Security Note
• https://bdu.fstec.ru/vul/2025-01613 · Security Note
• https://twitter.com/CVEnew/status/1889355105733861744 · Twitter Post
• https://t.me/cvedetector/17730 · Telegram Post
• https://t.me/cvenotify/129179 · Telegram Post