CVE-2024-40586

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-40586
An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local user to escalate his privileges via FortiSSLVPNd service pipe.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-23-279 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:*
History

16 Jul 2025, 15:11

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de control de acceso inadecuado [CWE-284] en FortiClient versión 7.4.0, versión 7.2.6 y anteriores, versión 7.0.13 y anteriores para Windows puede permitir que un usuario local aumente sus privilegios a través de la tubería de servicio FortiSSLVPNd.
References () https://fortiguard.fortinet.com/psirt/FG-IR-23-279 - () https://fortiguard.fortinet.com/psirt/FG-IR-23-279 - Vendor Advisory
CPE cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
cpe:2.3:a:fortinet:forticlient:7.4.0:*:*:*:*:windows:*:*
First Time Fortinet
Fortinet forticlient

11 Feb 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-11 17:15

Updated : 2025-07-16 15:11

NVD link : CVE-2024-40586

Mitre link : CVE-2024-40586

CVE.ORG link : CVE-2024-40586

JSON object : View

Products Affected

fortinet

  • forticlient
CWE
CWE-284

Improper Access Control