← Back

CVE-2024-36506

nvd nist
Published: Jan 14, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

An improper verification of source of a communication channel vulnerability [CWE-940] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, 6.4 all versions may allow a remote attacker to bypass the trusted host feature via session connection.

Affected (4)

Fortinet
2 products
Forticlientems
Forticlientems Cloud
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Forticlientems
From 6.4.0 to 7.2.5
Forticlientems
Version 7.4.0
Fortinet
Forticlientems Cloud
From 6.4.0 to 7.2.5
Forticlientems Cloud
Version 7.4.0

Related CWEs

CWE-940
Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.