CVE-2021-24019: An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the…

PriorityP354critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

3.84%

88.9th percentile

An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)

Affected

5 ranges

Vendor	Product	Version range	Fixed in
fortinet	forticlient_endpoint_management_server	< 6.2.9	6.2.9
fortinet	forticlient_endpoint_management_server	>= 6.4.0 < 6.4.2	6.4.2
fortinet	forticlientems	—	—
fortinet	forticlientendpointmanagementserver	—	—
fortinet	fortinet_forticlientems	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Monitor for reuse of admin session IDs in FortiClientEMS that remain valid after logout or session timeout, which may indicate session hijacking exploitation of CVE-2021-24019 ↗
→Alert on admin privilege escalation events in FortiClientEMS versions 6.4.2 and below, or 6.2.8 and below, particularly where session tokens are presented after expected expiry windows ↗

·The vulnerability is exploitable only if an attacker can first obtain a valid admin session ID through a separate attack vector; the session ID theft mechanism is not defined within this CVE ↗
·Both FortiClientEMS 6.4.x (≤6.4.2) and 6.2.x (≤6.2.8) branches are affected; ensure patching covers both release trains ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.