CVE-2024-52968: Fortinet FortiClient Authentication Bypass

CVE-2024-52968 is an authentication bypass flaw in Fortinet FortiClientMac that allows attackers to gain unauthorized access to macOS systems using an empty password. This article covers technical details, affected versions from 7.0.11 through 7.2.4, security impact, and recommended mitigation steps.

CVE-2024-52968 Overview

CVE-2024-52968 is an improper authentication vulnerability [CWE-287] affecting Fortinet FortiClient for macOS. The flaw exists in versions 7.0.11 through 7.2.4 and allows an attacker to gain improper access to macOS by supplying an empty password. The weakness lies in how FortiClientMac validates authentication credentials, permitting a bypass when no password value is provided. Successful exploitation compromises the confidentiality, integrity, and availability of the affected host.

Critical Impact
A local attacker can bypass FortiClient authentication on macOS by submitting an empty password, gaining improper access with high impact to system confidentiality, integrity, and availability.

Affected Products

Fortinet FortiClient for macOS 7.0.11 through 7.0.x
Fortinet FortiClient for macOS 7.2.0 through 7.2.4
Fortinet FortiClient for macOS 7.4.0

Discovery Timeline

2025-02-11 - CVE-2024-52968 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52968

Vulnerability Analysis

The vulnerability resides in the authentication handling logic of FortiClient for macOS. When a user or process submits credentials with an empty password field, the client fails to enforce a valid credential check. This condition maps to [CWE-287] Improper Authentication. The flaw enables an attacker with local access to interact with FortiClient functionality that should require valid authentication. Exploitation does not require prior privileges or user interaction on the target system.

Root Cause

The root cause is missing or incorrect validation of the password field during authentication. FortiClientMac accepts an empty string as a legitimate credential rather than rejecting it as an invalid input. This authentication logic error allows an attacker to satisfy the authentication step without knowing or supplying valid credentials. Improper input validation on the password parameter creates the bypass condition.

Attack Vector

Exploitation requires local access to a macOS system running an affected FortiClient version. An attacker submits an empty password to the authentication interface exposed by FortiClientMac. Because the client accepts the empty value, the attacker gains access to functions or resources that FortiClient controls. The attack complexity is low, and no privileges or user interaction are needed beyond local presence on the machine.

No public proof-of-concept code has been published for CVE-2024-52968. Refer to the Fortinet Security Advisory FG-IR-24-300 for vendor technical details.

Detection Methods for CVE-2024-52968

Indicators of Compromise

FortiClient authentication events on macOS endpoints where the supplied password field is empty or null.
Unexpected FortiClient session establishment or configuration changes on hosts running versions 7.0.11 through 7.2.4.
Local user or process interactions with FortiClient services outside normal administrative workflows.

Detection Strategies

Inventory macOS endpoints and identify systems running FortiClient versions between 7.0.11 and 7.2.4, or 7.4.0.
Review FortiClient logs on macOS for authentication attempts and correlate them with the local user account and process context.
Alert on FortiClient configuration or VPN state changes that do not correspond to authorized administrative activity.

Monitoring Recommendations

Forward FortiClient macOS logs to a centralized logging platform for retention and correlation.
Monitor macOS unified log entries related to FortiClient processes for anomalous authentication patterns.
Track privilege changes, credential access, and process execution associated with FortiClient binaries on macOS hosts.

How to Mitigate CVE-2024-52968

Immediate Actions Required

Upgrade FortiClient for macOS to a fixed version as specified in Fortinet advisory FG-IR-24-300.
Identify all macOS endpoints running FortiClient versions 7.0.11 through 7.2.4 and 7.4.0, and prioritize them for patching.
Restrict local access to affected macOS hosts until updates are applied.

Patch Information

Fortinet has released fixed FortiClient builds for macOS. Consult the Fortinet Security Advisory FG-IR-24-300 for the exact fixed version numbers and upgrade paths. Apply the vendor-supplied update across all affected macOS endpoints.

Workarounds

Limit interactive and remote local access to macOS systems running affected FortiClient versions.
Enforce full-disk encryption and screen lock policies to reduce opportunities for local exploitation.
Apply application allow-listing on macOS to constrain which processes may interact with FortiClient services.

bash

# Verify installed FortiClient version on macOS
defaults read /Applications/FortiClient.app/Contents/Info.plist CFBundleShortVersionString

# List FortiClient processes running on the host
ps -ax | grep -i forticlient