CVE-2021-43204: 
FortiClient vulnerability analysis and mitigation

A vulnerability identified as CVE-2021-43204 was discovered in Fortinet FortiClient Windows versions 6.4.1 and 6.4.0, version 6.2.9 and below, and version 6.0.10 and below. The vulnerability stems from improper control of a resource through its lifetime, which was disclosed in December 2021 (NVD, CVE).

The vulnerability is characterized by a CVSS v3.1 Base Score of 4.4 (Medium severity) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. The attack requires local access (AV:L), has low attack complexity (AC:L), requires high privileges (PR:H), needs no user interaction (UI:N), has unchanged scope (S:U), and while it has no impact on confidentiality (C:N) or integrity (I:N), it has a high impact on availability (A:H) (NVD).

The primary impact of this vulnerability is on system availability, where successful exploitation can result in a complete denial of service of FortiClient components. The attack vector involves changes to directory access permissions, which can significantly affect system functionality (NVD).

Fortinet has addressed this vulnerability through patches. Users are advised to upgrade to the latest version of FortiClient Windows that contains the security fixes (Fortinet Advisory).