CVE-2024-32119

MEDIUM4.8

An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7

Published Jun 10, 2025

Modified 8 months ago

Details

An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.

Affected Packages

FortiClient

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Affected versions:

7.4.0

References

ADVISORY

https://fortiguard.fortinet.com/psirt/FG-IR-23-375

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-32119

Aliases

FG-IR-23-375