CVE-2024-35282

Summary

A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an unauthenticated attacker that has physical access to a jailbroken device to obtain cleartext passwords via keychain dump.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiClientiOS7.2.0 <= 7.2.5affected
FortinetFortiClientiOS7.0.3 <= 7.0.9affected
FortinetFortiClientiOS7.0.0 <= 7.0.1affected
FortinetFortiClientiOS6.4.2 <= 6.4.6affected
FortinetFortiClientiOS6.4.0affected
FortinetFortiClientiOS6.2.1 <= 6.2.4affected
FortinetFortiClientiOS6.0.0 <= 6.0.5affected

Weaknesses

  • CWE-316: Information disclosure

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References