Fortinet FortiClient v7.4.0-7.2.6 DNS Spoofing CVE-2024-54019
CVE-2024-54019 Published on June 10, 2025
A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized attacker to redirect VPN connections via DNS spoofing or another form of redirection.
Vulnerability Analysis
CVE-2024-54019 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Improper Validation of Certificate with Host Mismatch
The software communicates with a host that provides a certificate, but the software does not properly ensure that the certificate is actually associated with that host.
Products Associated with CVE-2024-54019
Want to know whenever a new CVE is published for Fortinet FortiClient? stack.watch will email you.
Affected Versions
Fortinet FortiClientWindows:- Version 7.4.0 is affected.
- Version 7.2.0, <= 7.2.6 is affected.
- Version 7.0.0, <= 7.0.14 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.