Code Execution due to Node.JS Environment Variable Fortinet PSIRT Advisories Fortinet PSIRT Contact: Website: https://fortiguard.fortinet.com/faq/psirt-contact FG-IR-24-025 Final 1 1 2025-05-13T00:00:00 Current version 2025-05-13T00:00:00 2025-05-13T00:00:00 An improper isolation or compartmentalization vulnerability [CWE-653] in FortiClient MacOS and FortiVoiceUC desktop application may allow an authenticated attacker to inject code via Electron environment variables. None Execute unauthorized code or commands None Fortinet is pleased to thank YoKo Kho and Fahad Alamri from HakTrak Cybersecurity Squad, Mykola Grymalyuk, Roberto "espret0" Soares from Hakai Security, Kahabordee Pinjai and Kusol Watchara-ApanukornCompany from Sec Strike Research team and Nissana Sirijirakal from SnoopBees Co., Ltd. for reporting this vulnerability under responsible disclosure. FortiClientMac 7.4.2 FortiClientMac 7.4.1 FortiClientMac 7.4.0 FortiClientMac 7.2.8 FortiClientMac 7.2.7 FortiClientMac 7.2.6 FortiClientMac 7.2.5 FortiClientMac 7.2.4 FortiClientMac 7.2.3 FortiClientMac 7.2.2 FortiClientMac 7.2.1 FortiClientMac 7.2.0 FortiClientMac 7.0.14 FortiClientMac 7.0.13 FortiClientMac 7.0.12 FortiClientMac 7.0.11 FortiClientMac 7.0.10 FortiClientMac 7.0.9 FortiClientMac 7.0.8 FortiClientMac 7.0.7 FortiClientMac 7.0.6 FortiClientMac 7.0.5 FortiClientMac 7.0.4 FortiClientMac 7.0.3 FortiClientMac 7.0.2 FortiClientMac 7.0.1 FortiClientMac 7.0.0 FortiVoiceUCDesktop 3.0.16 FortiVoiceUCDesktop 3.0.15 FortiVoiceUCDesktop 3.0.14 FortiVoiceUCDesktop 3.0.13 FortiVoiceUCDesktop 3.0.12 FortiVoiceUCDesktop 3.0.11 FortiVoiceUCDesktop 3.0.10 FortiVoiceUCDesktop 3.0.9 FortiVoiceUCDesktop 3.0.8 FortiVoiceUCDesktop 3.0.7 FortiVoiceUCDesktop 3.0.6 FortiVoiceUCDesktop 3.0.5 FortiVoiceUCDesktop 3.0.4 FortiVoiceUCDesktop 3.0.3 FortiVoiceUCDesktop 3.0.2 FortiVoiceUCDesktop 3.0.1 FortiVoiceUCDesktop 3.0.0 CVE-2024-35281 FortiClientMac-7.4.2 FortiClientMac-7.4.1 FortiClientMac-7.4.0 FortiClientMac-7.2.8 FortiClientMac-7.2.7 FortiClientMac-7.2.6 FortiClientMac-7.2.5 FortiClientMac-7.2.4 FortiClientMac-7.2.3 FortiClientMac-7.2.2 FortiClientMac-7.2.1 FortiClientMac-7.2.0 FortiClientMac-7.0.14 FortiClientMac-7.0.13 FortiClientMac-7.0.12 FortiClientMac-7.0.11 FortiClientMac-7.0.10 FortiClientMac-7.0.9 FortiClientMac-7.0.8 FortiClientMac-7.0.7 FortiClientMac-7.0.6 FortiClientMac-7.0.5 FortiClientMac-7.0.4 FortiClientMac-7.0.3 FortiClientMac-7.0.2 FortiClientMac-7.0.1 FortiClientMac-7.0.0 FortiVoiceUCDesktop-3.0.16 FortiVoiceUCDesktop-3.0.15 FortiVoiceUCDesktop-3.0.14 FortiVoiceUCDesktop-3.0.13 FortiVoiceUCDesktop-3.0.12 FortiVoiceUCDesktop-3.0.11 FortiVoiceUCDesktop-3.0.10 FortiVoiceUCDesktop-3.0.9 FortiVoiceUCDesktop-3.0.8 FortiVoiceUCDesktop-3.0.7 FortiVoiceUCDesktop-3.0.6 FortiVoiceUCDesktop-3.0.5 FortiVoiceUCDesktop-3.0.4 FortiVoiceUCDesktop-3.0.3 FortiVoiceUCDesktop-3.0.2 FortiVoiceUCDesktop-3.0.1 FortiVoiceUCDesktop-3.0.0 2.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R https://fortiguard.fortinet.com/psirt/FG-IR-24-025 Code Execution due to Node.JS Environment Variable Reference>