CVE-2024-40586

MEDIUM EPSS 14.1%

Published Feb 11, 20251y ago · Modified Jun 17, 20261w ago

6.7 CVSS 3.1

Medium

Published Feb 11, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow a local user to escalate his privileges via FortiSSLVPNd service pipe.

CVSS Details

Base Score

6.7

Exploitability

0.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

14.1% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-284

Affected Products 3

Vendor	Product	Version	Range
fortinet	forticlient	*	≥7.0.3 – <7.0.14
fortinet	forticlient	*	≥7.2.0 – <7.2.7
fortinet	forticlient	7.4.0	any

References 1

fortiguard.fortinet.com https://fortiguard.fortinet.com/psirt/FG-IR-23-279

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.