CVE-2024-23106: High Brute Force Risk in FortiClientEMS

CVE-2024-23106 is a high severity (CVSS 8.1) flaw in Fortinet FortiClientEMS that fails to limit repeated login attempts, so an unauthenticated attacker can brute force the console over HTTP or HTTPS. Fortinet's fix is 7.2.5 or later on the 7.2 branch and 7.0.11 or later on 7.0.

What's affected

Per Fortinet advisory FG-IR-23-476, published January 14, 2025:

• FortiClientEMS 7.4: not affected.
• FortiClientEMS 7.2: 7.2.0 through 7.2.3 affected. Upgrade to 7.2.5 or above.
• FortiClientEMS 7.0: 7.0.0 through 7.0.10 affected. Upgrade to 7.0.11 or above.
• FortiClientEMS 6.4 and 6.2: all versions affected. Migrate to a fixed release.

The NVD text gives slightly different ranges (7.2.0 through 7.2.4 and before 7.0.10). Use the vendor table and upgrade past the highest number in either source. Fortinet lists the issue as discovered internally, with no known exploitation.

How to check if you're exposed

Fortinet products show their firmware version on the dashboard or in the command line. On the CLI, the status command prints it:

get system status

Compare the reported version with the affected and fixed versions above. If your branch is listed as migrate to a fixed release, there is no patch on that branch and you need to move to a supported one.

What to do now

1. Upgrade FortiClientEMS to the fixed release for your branch, or migrate off 6.4 and 6.2.
2. Restrict the management console to admin networks. It should not be reachable from the internet.
3. Enable multi-factor authentication for console administrators where the product supports it.
4. Alert on bursts of failed logins against the console.
5. Review admin accounts for weak or shared passwords and replace them.

Why it matters

The class is CWE-307, improper restriction of excessive authentication attempts. Without a lockout or rate limit, an attacker can try passwords as fast as the server answers. A strong password slows this down but does not remove the risk.

The score is 8.1 rather than critical because the attack complexity is rated high. Success depends on guessing a valid credential. A console that manages endpoint security agents is a high-value target, so a successful guess matters. Putting the console behind a VPN removes most of the exposure while you schedule the upgrade.

Lockout rules are cheap to add and easy to forget. If you run other consoles with the same exposure, check each one for a failed-login limit, an alert on repeated failures and multi-factor authentication. A password manager and unique admin credentials per system also stop one guessed password from opening several doors.

Quick check

Sources

• Fortinet PSIRT advisory FG-IR-23-476

Last reviewed: 19 October 2026.