CVE-2024-33508 | FortiClientEMS - Database Operational Intel

Executive Risk Summary

"A Command Injection vulnerability in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database. This vulnerability poses a risk to the integrity of the database and potentially the entire system."

Operational Audit Arsenal

Target Type Database

Target Asset FortiClientEMS Database

Standard Path Management Plane

Manual Verification Required

This is a non-Windows asset (Fortinet). Use the target asset details above to verify your version against vendor advisories.

Patch Impact Forecast

Reboot Required Likely

Moderate

Internal Work Notes

FortiClientEMS Command Injection vulnerability (CVE-2024-33508) - verify version and apply patch to prevent unauthorized database access

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-24-123

Scope of Impact

Fortinet Forticlient Enterprise Management Server

Original NVD Description

"An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted requests."

Related Fortinet Threats

CVE-2024-23108 CVSS 10

FortiGate - API

CVE-2024-23109 CVSS 10

FortiGate - API

CVE-2023-34992 CVSS 10

FortiGate - API

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.