CVE-2024-40592 MEDIUM

CVE-2024-40592

Vendor Fortinet
Product FortiClientMac
Weakness CWE-347
Published November 12, 2024
Last update November 13, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

What the vulnerability does

01Description

An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.

Key dates

02Disclosure timeline

November 12, 2024 CVE published
November 13, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-42193 Plunk: SNS webhook forgery CVE-2026-34068 nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge CVE-2026-44309 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits CVE-2026-44497 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer CVE-2026-34377 Zebra has a Consensus Failure due to Improper Verification of V5 Transactions