FG-IR-24-216: Hardcoded Encryption Key Used for Named Pipe Communication
Published Jan 14, 2025
·Updated
A use of hard-coded cryptographic key (CWE-321) vulnerability in FortiClient Windows may allow a low-privileged user to decrypt interprocess communication via monitoring named pipe.
Affected Software
4 affected componentsFixes available
Fortinet FortiClientWindows=.
Fortinet FortiClientWindows>=7.2.0<=7.2.8
Fortinet FortiClientWindows>=7.0
Fortinet FortiClientWindows>=6.4
Event History
Jan 14, 2025
Advisory Published
via FortiGuard·12:00 AM
Apr 20, 2025
Advisory Published
via FortiGuard·03:21 PM
Frequently Asked Questions
1
What is the severity of FG-IR-24-216?
The FG-IR-24-216 vulnerability is classified as a low-severity issue.
2
How do I fix FG-IR-24-216?
To fix FG-IR-24-216, update FortiClient Windows to version 7.4.1 or 7.2.9, or ensure you are using a version above 7.2.8.
3
Who is affected by FG-IR-24-216?
FG-IR-24-216 affects FortiClient Windows versions 6.4, 7.0, and below 7.2.9.
4
What type of vulnerability is FG-IR-24-216?
FG-IR-24-216 is a use of hard-coded cryptographic key vulnerability (CWE-321).
5
What can a low-privileged user do to exploit FG-IR-24-216?
A low-privileged user may exploit FG-IR-24-216 to decrypt interprocess communication by monitoring a named pipe.