CVE-2024-47574
First published: Wed Nov 13 2024(Updated: )
A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiClient SSL VPN | >=6.4.0<7.0.13 | |
| Fortinet FortiClient SSL VPN | >=7.2.0<7.2.5 | |
| Fortinet FortiClient SSL VPN | =7.4.0 | |
| Fortinet FortiClient Virtual Private Network | =7.4.0>=7.2.0<=7.2.4>=7.0.0<=7.0.12>=6.4.0<=6.4.10 |
Remedy
Please upgrade to FortiClientWindows version 7.4.1 or above Please upgrade to FortiClientWindows version 7.2.5 or above Please upgrade to FortiClientWindows version 7.0.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-47574?
CVE-2024-47574 is categorized as a high-severity vulnerability due to the potential for arbitrary code execution with high privileges.
How do I fix CVE-2024-47574?
To fix CVE-2024-47574, users should update their Fortinet FortiClient to the latest version that addresses this vulnerability.
Who is affected by CVE-2024-47574?
CVE-2024-47574 affects users running Fortinet FortiClient versions 7.4.0, 7.2.4 down to 7.2.0, 7.0.12 down to 7.0.0, and 6.4.10 down to 6.4.0.
What type of vulnerability is CVE-2024-47574?
CVE-2024-47574 is an authentication bypass vulnerability that allows low privilege attackers to execute arbitrary code.
What can attackers achieve with CVE-2024-47574?
Attackers exploiting CVE-2024-47574 can execute arbitrary code with high privileges through spoofed named pipe messages.
- agent/remedy
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- collector/the-register
- source/The Register
- alias/CVE-2024-47574
- alias/CVE-2024-50564
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/last-modified-date
- agent/weakness
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- vendor/fortinet
- canonical/fortinet forticlient ssl vpn
- version/fortinet forticlient ssl vpn/6.4.0
- version/fortinet forticlient ssl vpn/7.2.0
- version/fortinet forticlient ssl vpn/7.4.0
- canonical/fortinet forticlient virtual private network