CVE-2024-32119

MEDIUM

Fortinet FortiClientEMS <7.2.4 - Auth Bypass

Title source: llm

Description

An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests.

References (1)

[Vendor Advisory] https://fortiguard.fortinet.com/psirt/FG-IR-23-375

Scores

CVSS v3 4.8

EPSS 0.0002

EPSS Percentile 4.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Classification

CWE

CWE-1390

Status published

Affected Products (2)

fortinet/forticlientems < 6.2.9

fortinet/forticlientems

Timeline

Published Jun 10, 2025

Tracked Since Feb 18, 2026