CVE-2024-31489: fortinet forticlient Improper Certificate Validation
Vulnerability summary
CVE-2024-31489 is a high (CVSS 8.1) Improper Certificate Validation vulnerability in fortinet forticlient. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.9% of scored vulnerabilities.
Timeline
- 10-09-2024PublishedVulnerability first disclosed.
- 10-09-2024Last modifiedVulnerability information updated.
Description
AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiGate and the FortiClient during the ZTNA tunnel creation
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.4MediumCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:U/RC:CDiffers
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
29%
Versus all other CVEs
30-day change
0.00 pp
From 0.36% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fortinet5 products
- forticlient≥ 7.0.0, < 7.0.12 | ≥ 7.2.0, < 7.2.3 | ≥ 7.2.0, < 7.2.5 | 7.2.0
- forticlientems≥ 7.0.0, ≤ 7.0.13
- forticlientlinux7.2.0 | ≥ 7.0.0, ≤ 7.0.11
- forticlientmac≥ 7.2.0, ≤ 7.2.4 | ≥ 7.0.0, ≤ 7.0.11
- forticlientwindows≥ 7.2.0, ≤ 7.2.2 | ≥ 7.0.0, ≤ 7.0.11
1 vendor · 5 products
References
1 links- fortiguard.fortinet.com/psirt/FG-IR-22-282Vendor Advisory