CVE-2024-23106

Summary

An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack against the FortiClientEMS console via crafted HTTP or HTTPS requests.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiClientEMS7.2.0 <= 7.2.3affected
FortinetFortiClientEMS7.0.0 <= 7.0.10affected
FortinetFortiClientEMS6.4.7 <= 6.4.9affected
FortinetFortiClientEMS6.4.0 <= 6.4.4affected
FortinetFortiClientEMS6.2.6 <= 6.2.9affected
FortinetFortiClientEMS6.2.0 <= 6.2.4affected

Weaknesses

  • CWE-307: Improper access control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References