Fortinet Security Update – 13 November 2024

The addressed vulnerabilities could allow the attacker to bypass security restrictions, gain elevated privileges, obtain sensitive information, or execute arbitrary code and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Fortinet FortiClient Windows Privilege Escalation Vulnerability (CVE-2024- 36513):

• CVSS: 7.4
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Consequences: Privilege Escalation

2. Fortinet FortiOS SSL VPN Session Hijacking Vulnerability (CVE-2023-50176):

• CVSS: 7.1
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: Required
• Consequences: Session Hijacking

Sample of the affected products:

• FortiPortal.
• FortiManager.
• FortiOS.
• FortiProxy.
• FortiAnalyzer.
• FortiClientWindows.
• FortiAnalyzer-BigData.