CVE-2024-54019 Overview
CVE-2024-54019 is an improper certificate validation vulnerability affecting Fortinet FortiClient for Windows. The flaw stems from a host mismatch during certificate validation, classified under [CWE-297]. An unauthorized network attacker can redirect Virtual Private Network (VPN) connections through Domain Name System (DNS) spoofing or other redirection techniques. The vulnerability affects FortiClientWindows 7.4.0, versions 7.2.0 through 7.2.6, and all 7.0 versions. Fortinet published the advisory as FG-IR-24-365.
Critical Impact
Attackers positioned to manipulate DNS or network routing can redirect FortiClient VPN sessions to attacker-controlled endpoints, exposing corporate access channels to interception.
Affected Products
- Fortinet FortiClientWindows 7.4.0
- Fortinet FortiClientWindows 7.2.0 through 7.2.6
- Fortinet FortiClientWindows 7.0 (all versions)
Discovery Timeline
- 2025-06-10 - CVE-2024-54019 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-54019
Vulnerability Analysis
The vulnerability resides in how FortiClientWindows validates the server certificate presented during VPN connection establishment. The client fails to properly verify that the certificate's hostname matches the intended VPN gateway. This allows a certificate that is otherwise trusted, or presented through a redirected connection, to be accepted for an unintended host. The attack requires network positioning but no authentication or user interaction.
Root Cause
The root cause is improper validation of certificate with host mismatch [CWE-297]. FortiClient does not enforce strict binding between the certificate Subject Alternative Name or Common Name and the configured VPN server hostname. When the client receives a certificate during the Transport Layer Security (TLS) handshake, host verification is either missing or incomplete, weakening the trust anchor that VPN clients depend on.
Attack Vector
An attacker on the network path performs DNS spoofing, Address Resolution Protocol (ARP) poisoning, or router-level redirection to steer the FortiClient VPN session to a rogue endpoint. Because the client does not enforce hostname binding, the attacker's server can complete the TLS handshake and negotiate the VPN session. This enables interception or manipulation of VPN traffic and credential relay against the legitimate gateway. Refer to the Fortinet Security Advisory FG-IR-24-365 for vendor technical detail.
Detection Methods for CVE-2024-54019
Indicators of Compromise
- Unexpected DNS responses for configured FortiClient VPN gateway hostnames, particularly resolving to non-corporate IP ranges.
- FortiClient VPN sessions established against IP addresses that do not match published gateway inventories.
- Certificate fingerprints observed in VPN handshakes that differ from the organization's issued gateway certificates.
Detection Strategies
- Monitor endpoint logs for FortiClient version strings matching 7.0.x, 7.2.0 through 7.2.6, or 7.4.0 to inventory exposed hosts.
- Correlate DNS query logs with VPN connection telemetry to flag resolutions outside sanctioned gateway ranges.
- Inspect TLS metadata on outbound VPN traffic and alert when server certificate Common Name or Subject Alternative Name entries diverge from approved gateways.
Monitoring Recommendations
- Enable DNS Security Extensions (DNSSEC) validation and log validation failures on resolvers used by remote workers.
- Capture and retain VPN authentication events with source IP, destination IP, and certificate hash for retrospective analysis.
- Alert on repeated VPN reconnects from a single endpoint following network changes, which can indicate active redirection attempts.
How to Mitigate CVE-2024-54019
Immediate Actions Required
- Inventory all Windows endpoints running FortiClient and identify installations in the affected version ranges.
- Upgrade FortiClientWindows to a fixed release as specified in Fortinet advisory FG-IR-24-365.
- Restrict VPN client usage on untrusted networks until patched builds are deployed.
Patch Information
Fortinet has published remediation guidance in advisory FG-IR-24-365. Administrators should consult the vendor advisory for the exact fixed versions across the 7.0, 7.2, and 7.4 branches and deploy updates through their standard endpoint management workflow. Verify successful installation by validating the client version after upgrade.
Workarounds
- Enforce certificate pinning or restricted trust stores where FortiClient deployment options allow it.
- Require remote users to connect through trusted networks or corporate hotspots that provide validated DNS resolution.
- Deploy DNSSEC-aware resolvers and block outbound DNS to unauthorized servers via egress firewall rules.
# Configuration example
# Query installed FortiClient version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\Fortinet\FortiClient\FA_UI" | Select-Object Version
# Enforce corporate DNS only (block rogue resolvers)
netsh advfirewall firewall add rule name="Block External DNS" dir=out action=block protocol=UDP remoteport=53 remoteip=any
netsh advfirewall firewall add rule name="Allow Corp DNS" dir=out action=allow protocol=UDP remoteport=53 remoteip=10.0.0.53
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
