Low-privilege attacker can execute arbitrary code with high privileges via spoofed named pipe messages
CVE-2024-47574

7.8HIGH

Key Information:

Vendor

Fortinet
Status
Forticlient
Vendor
CVE Published:
13 November 2024

Badges

👾 Exploit Exists

What is CVE-2024-47574?

An authentication bypass vulnerability in Fortinet's FortiClient allows low-privilege attackers to execute arbitrary code by exploiting a weakness in the named pipe messaging system. This flaw affects multiple versions, providing avenues for potential unauthorized access and execution of malicious actions. Organizations using the impacted versions are advised to apply updates to safeguard against exploitation.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-199

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

.