What is the CVSS score of CVE-2024-23106?

CVE-2024-23106 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Forticlientems are affected by CVE-2024-23106?

Organizations using FortiClientEMS face notable risk from CVE-2024-23106, a brute-force weakness vulnerability rated CVSS 8.1.

How to fix or mitigate CVE-2024-23106?

Within 30 days: Identify all affected systems running FortiClientEMS and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Forticlientems CVE-2024-23106

HIGH

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2025-01-14 psirt@fortinet.com

Information Disclosure Forticlientems

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:03 vuln.today

CVE Published

Jan 14, 2025 - 14:15 nvd

HIGH 8.1

DescriptionCVE.org

An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack against the FortiClientEMS console via crafted HTTP or HTTPS requests.

AnalysisAI

An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-307. An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack against the FortiClientEMS console via crafted HTTP or HTTPS requests. Affected products include: Fortinet Forticlientems. Version information: version 7.2.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.