CVE-2024-36510: Fortinet FortiClientEMS User Enumeration

CVE-2024-36510 Overview

CVE-2024-36510 is an observable response discrepancy vulnerability [CWE-204] affecting Fortinet FortiClientEMS and FortiSOAR. The flaw allows an unauthenticated remote attacker to enumerate valid usernames by observing differences in login request responses. Successful enumeration provides adversaries with a curated list of valid accounts to feed into credential stuffing, password spraying, or targeted phishing campaigns.

The vulnerability is network-exploitable, requires no authentication, and no user interaction. It impacts confidentiality only, as no data modification or availability impact occurs.

Critical Impact
Unauthenticated attackers can enumerate valid user accounts on exposed FortiClientEMS and FortiSOAR instances, enabling downstream credential attacks against enterprise identity infrastructure.

Affected Products

Fortinet FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, and 7.0 (all versions)
Fortinet FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through 7.3.2
Fortinet FortiSOAR 7.2, 7.0, and 6.4 (all versions)

Discovery Timeline

2025-01-14 - CVE-2024-36510 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36510

Vulnerability Analysis

The vulnerability arises from inconsistent authentication response behavior in the login endpoints of FortiClientEMS and FortiSOAR. When an attacker submits login attempts, the application's response varies depending on whether the submitted username corresponds to a valid account. These observable differences may include response body content, HTTP status codes, header composition, or timing characteristics.

An attacker automates login attempts against a wordlist of candidate usernames. By comparing responses, the attacker distinguishes valid accounts from invalid ones without triggering successful authentication events. The technique bypasses lockout controls tied to specific accounts because no correct credential is ever submitted.

The enumerated username set then feeds credential-based attacks. FortiClientEMS manages endpoint policy for enterprise fleets and FortiSOAR orchestrates security operations workflows, so account compromise on either product carries operational consequences.

Root Cause

The root cause is a violation of CWE-204: Observable Response Discrepancy, closely related to [CWE-203: Observable Discrepancy]. The login handlers return distinguishable responses for valid versus invalid usernames instead of returning a uniform, generic authentication failure message. Secure authentication implementations must return identical responses and consistent timing regardless of whether the username exists.

Attack Vector

Exploitation requires network access to the FortiClientEMS or FortiSOAR web interface. The attacker issues repeated authentication requests using candidate usernames, records response characteristics, and classifies each username as valid or invalid based on observed differences. No credentials, tokens, or user interaction are required. The attack is silent from a target-account perspective because no successful logins occur.

Refer to the Fortinet Security Advisory FG-IR-24-071 for authoritative technical details.

Detection Methods for CVE-2024-36510

Indicators of Compromise

High-volume authentication failures from a single source IP or narrow IP range against the FortiClientEMS or FortiSOAR login endpoint.
Sequential or dictionary-ordered usernames appearing in authentication logs within short time windows.
Login attempts targeting many distinct usernames without repeated attempts against any single account.
Requests originating from anonymizing services, cloud provider ranges, or known scanning infrastructure.

Detection Strategies

Baseline normal login request rates per source IP and alert on deviations exceeding the baseline threshold.
Correlate failed logins across distinct usernames to identify enumeration patterns rather than traditional brute force.
Monitor for User-Agent strings associated with automation frameworks such as curl, python-requests, or hydra.
Ingest FortiClientEMS and FortiSOAR authentication telemetry into a SIEM for cross-source correlation with identity provider logs.

Monitoring Recommendations

Enable verbose authentication logging on FortiClientEMS and FortiSOAR management interfaces.
Forward logs to a centralized analytics platform with retention sufficient for enumeration-window analysis.
Alert on downstream credential stuffing indicators against enumerated accounts in Active Directory, Entra ID, or federated identity providers.

How to Mitigate CVE-2024-36510

Immediate Actions Required

Apply the fixed versions listed in the Fortinet Security Advisory FG-IR-24-071 for both FortiClientEMS and FortiSOAR.
Restrict administrative and login interfaces to trusted management networks using firewall or VPN controls.
Enforce multi-factor authentication on all FortiClientEMS and FortiSOAR accounts to blunt credential-based follow-on attacks.
Rotate credentials for accounts flagged during log review, especially privileged administrator accounts.

Patch Information

Fortinet has published fixed release information in advisory FG-IR-24-071. Upgrade FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, and 7.0 branches, and FortiSOAR 7.5.0, 7.4.x, 7.3.x, 7.2, 7.0, and 6.4 branches to the vendor-designated fixed versions. Consult the advisory for exact target versions per affected branch.

Workarounds

Place the login interface behind a reverse proxy or web application firewall configured with rate limiting per source IP.
Deploy IP allowlisting so that only known administrator source ranges can reach the authentication endpoints.
Require VPN or zero-trust network access before users can reach the FortiClientEMS or FortiSOAR web interface.

bash

# Example: rate-limit and restrict access to the management interface
# Using iptables to allow only trusted admin subnet and rate-limit others
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW \
  -m recent --set --name FCEMS_LOGIN
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW \
  -m recent --update --seconds 60 --hitcount 10 --name FCEMS_LOGIN -j DROP