Low-privilege attacker can execute arbitrary code with high privileges via spoofed named pipe messages

Summary

A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages.

News Articles

CVE-2024-47574CVE-2024-50564

High-severity Fortinet VPN flaw allows privilege escalation

A now-patched, high-severity bug in Fortinet's FortiClient VPN application potentially allows a low-privilege rogue user or malware on a vulnerable Windows system to gain higher privileges from another user,...

1 week ago