CVE-2024-35281

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClientMac version 7.4.2 and below, version 7.2.8 and below, 7.0 all versions and FortiVoiceUCDesktop 3.0 all versions desktop application may allow an authenticated attacker to inject code via Electron environment variables.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-653

Affected software

Vendor	Product	Versions
Fortinet	FortiClientMac	>= 7.4.0, <= 7.4.2; >= 7.2.0, <= 7.2.8; >= 7.0.0, <= 7.0.14
Fortinet	FortiVoiceUCDesktop	>= 3.0.0, <= 3.0.16

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-025Vendor Advisory

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-352824.6A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versi CVE-2024-352836.1A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to condu CVE-2024-352845.4A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to CVE-2024-352859.8A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command inject CVE-2024-352869.8A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection CVE-2024-352876.7A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated at CVE-2024-352887.8Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occu CVE-2024-35296.1A vulnerability was found in Campcodes Complete Online Student Management System 1.0. It has been classified as problematic. This affects an CVE-2024-352916.1Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is exploited, an arbitra CVE-2024-352928.2A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES CVE-2024-352939.1An unauthenticated remote attacker may use a missing authentication for critical function vulnerability to reboot or erase the affected devi CVE-2024-352946.5An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.