CVE-2024-32119 Overview
CVE-2024-32119 is an improper authentication vulnerability [CWE-287] affecting Fortinet FortiClientEMS. The flaw allows an unauthenticated attacker who knows a target user's FCTUID and VDOM to perform actions such as uploading or tagging on behalf of that user. Exploitation requires specially crafted TCP requests to the FortiClientEMS service. The issue impacts FortiClientEMS version 7.4.0 and versions prior to 7.2.4. Fortinet published the fix and advisory tracked as FG-IR-23-375.
Critical Impact
Attackers with knowledge of a user's FCTUID and VDOM values can impersonate that user to upload files or tag endpoints without valid authentication.
Affected Products
- Fortinet FortiClientEMS 7.4.0
- Fortinet FortiClientEMS versions prior to 7.2.4
- Fortinet FortiClientEMS 7.2.x (before 7.2.4)
Discovery Timeline
- 2025-06-10 - CVE-2024-32119 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-32119
Vulnerability Analysis
The vulnerability resides in how FortiClientEMS authenticates operations submitted over TCP. The server accepts requests that identify the acting user via FCTUID and VDOM values without enforcing a proper authentication challenge. An attacker who has obtained or guessed these identifiers can issue requests that the service processes as if they came from the legitimate user.
The integrity and availability impact is limited, and the attack requires high complexity because the attacker must know valid FCTUID and VDOM values. There is no confidentiality impact and no user interaction is required.
The EPSS probability for near-term exploitation is 0.326%. No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is missing or insufficient authentication on operations that trust client-supplied identity values. FortiClientEMS uses the FCTUID (FortiClient unique identifier) and VDOM (virtual domain) fields to attribute requests, but does not require a cryptographic proof that the requester actually owns those identifiers. This is a classic Improper Authentication weakness aligned with [CWE-287].
Attack Vector
The attack vector is network-based. An attacker sends specially crafted TCP requests to the FortiClientEMS service containing a target user's FCTUID and VDOM. Once accepted, the attacker can perform operations such as uploading files or tagging on behalf of the target. Because the required identifiers are not secrets designed to resist guessing, an attacker who has previously observed traffic, compromised an endpoint, or otherwise recovered these values can perform impersonation.
See the Fortinet Security Advisory FG-IR-23-375 for vendor technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-32119
Indicators of Compromise
- Unexpected file uploads or tag changes attributed to users who did not initiate the action.
- TCP connections to the FortiClientEMS management port from hosts not enrolled as FortiClient endpoints.
- Repeated requests carrying different FCTUID values from the same source address, indicating identifier enumeration.
Detection Strategies
- Correlate FortiClientEMS audit logs of upload and tagging operations against expected user activity windows and source endpoints.
- Alert on operations where the source IP does not match the last known IP of the endpoint associated with the FCTUID.
- Baseline normal TCP client traffic to FortiClientEMS and flag deviations in volume, source, or request patterns.
Monitoring Recommendations
- Forward FortiClientEMS server logs to a centralized logging platform for retention and correlation.
- Monitor management network segments for unauthorized hosts attempting to reach FortiClientEMS TCP services.
- Review privileged operations such as endpoint tagging and file uploads on a scheduled basis for anomalies.
How to Mitigate CVE-2024-32119
Immediate Actions Required
- Upgrade FortiClientEMS to version 7.2.4 or later, or to a fixed 7.4.x release per Fortinet guidance.
- Restrict network reachability of the FortiClientEMS management service to trusted endpoint subnets only.
- Audit recent upload and tagging operations for activity that does not match expected user behavior.
Patch Information
Fortinet addressed the issue in FortiClientEMS 7.2.4 and later. Version 7.4.0 is affected and should be upgraded to a fixed release identified in the vendor advisory. Refer to Fortinet Security Advisory FG-IR-23-375 for the current list of fixed builds.
Workarounds
- Place FortiClientEMS behind network segmentation that limits TCP access to managed endpoints and administrative jump hosts.
- Enforce strict firewall rules on the FortiClientEMS server to drop unsolicited TCP connections from untrusted sources.
- Rotate or invalidate exposed FCTUID values by re-enrolling affected endpoints where feasible.
# Example firewall restriction limiting FortiClientEMS TCP access
# Replace <FCTEMS_IP>, <PORT>, and <MANAGED_SUBNET> with environment-specific values
iptables -A INPUT -p tcp -d <FCTEMS_IP> --dport <PORT> -s <MANAGED_SUBNET> -j ACCEPT
iptables -A INPUT -p tcp -d <FCTEMS_IP> --dport <PORT> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
