Fortinet FortiClient Host Security fortimon.sys Crafted Request Local Privilege Escalation

high Nessus Plugin ID 31347

Synopsis

The remote Windows host contains a device driver that is affected by a local privilege escalation vulnerability.

Description

FortiClient is installed on the remote host, providing it with a range of security-related functionality.

The version of the fortimon.sys device driver installed on the remote host as part of FortiClient allows a local user to escalate his privileges by issuing a special request to the driver's device.

Solution

Upgrade to Fortinet FortiClient 3.0 MR5 Patch 4 (build 474) / 3.0 MR6 (build 534) or later.

Plugin Details

Severity: High

ID: 31347

File Name: forticlient_fortimon_priv_escalation.nasl

Version: 1.14

Type: local

Agent: windows

Family: Windows

Published: 3/4/2008

Updated: 3/27/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2008-0779

Vulnerability Information

CPE: cpe:/a:fortinet:forticlient

Required KB Items: installed_sw/FortiClient

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2008-0779

BID: 27776

CWE: 264

Secunia: 28975

Detections

Analytics