« Volver al listado

CVE-2024-35282

Estado: AnalizadaMedia (4.6)—

A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an unauthenticated attacker that has physical access to a jailbroken device to obtain cleartext passwords via keychain dump.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Fortinet — Forticlient

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-35282",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35282",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T17:32:37.826003Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@fortinet.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.2,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.6,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@fortinet.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:forticlientios:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:7.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:forticlientios:6.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "Fortinet",
          "product": "FortiClientiOS",
          "versions": [
            {
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.5"
            },
            {
              "status": "affected",
              "version": "7.0.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.9"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.1"
            },
            {
              "status": "affected",
              "version": "6.4.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.6"
            },
            {
              "status": "affected",
              "version": "6.4.0"
            },
            {
              "status": "affected",
              "version": "6.2.1",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.4"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.5"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-09-10T15:15:16.397",
  "references": [
    {
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-139",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@fortinet.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@fortinet.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-316"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versions, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an unauthenticated attacker that has physical access to a jailbroken device to obtain cleartext passwords via keychain dump."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de almacenamiento de texto plano de información confidencial en la memoria [CWE-316] que afecta a FortiClient VPN iOS 7.2 todas las versiones, 7.0 todas las versiones, 6.4 todas las versiones, 6.2 todas las versiones, 6.0 todas las versiones puede permitir que un atacante no autenticado que tenga acceso físico a un dispositivo con jailbreak obtenga contraseñas en texto plano a través de un volcado de llavero."
    }
  ],
  "lastModified": "2026-06-17T07:34:40.823",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4C7743A-14D7-4DB0-A1CF-520D8A3E582B",
              "versionEndIncluding": "7.2.5",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com"
}