CyberCVE

CVE-2024-36513

A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their

Severity
High 7.4
CVSS 3.1
Adjacent, local or physical access what this means
Exploited
Not listed
EPSS
0.002
11.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
Nov 12, 2024
Assigned by fortinet

Description

A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts.

Weakness: CWE-270

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiClientWindows
  • fortinet · forticlientwindows

Credit

Internally discovered and reported by Mengyao Zhang of Fortinet Development team.

Vendor remediation

Please upgrade to FortiClientWindows version 7.4.0 or above Please upgrade to FortiClientWindows version 7.2.5 or above Please upgrade to FortiClientWindows version 7.0.13 or above Please upgrade to FortiClientWindows version 6.4.11 or above

References

Something wrong here?