PT-2025-23068 · Fortinet · Forticlient

Published 2025-05-13 · Updated 2025-06-04 · CVE-2025-25251

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiClient Mac versions 7.0.0 through 7.0.14 FortiClient Mac versions 7.2.0 through 7.2.8 FortiClient Mac versions 7.4.0 through 7.4.2

Description The issue is related to an Incorrect Authorization vulnerability that may allow a local attacker to escalate privileges. This can be achieved via crafted XPC messages.

Recommendations For FortiClient Mac versions 7.0.0 through 7.0.14, update to a version outside of this range to resolve the issue. For FortiClient Mac versions 7.2.0 through 7.2.8, update to a version outside of this range to resolve the issue. For FortiClient Mac versions 7.4.0 through 7.4.2, update to a version outside of this range to resolve the issue.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-09929

CVE-2025-25251

Affected Products

Forticlient

References · 10

• https://fortiguard.fortinet.com/psirt/FG-IR-25-016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25251 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09929 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-25251 · Security Note
• https://t.me/cvetracker/24801 · Telegram Post
• https://twitter.com/CCBalert/status/1927740860269035795 · Twitter Post
• https://t.me/cvenotify/124609 · Telegram Post
• https://twitter.com/CVEnew/status/1927641280462389530 · Twitter Post
• https://twitter.com/cracbot/status/1929493239259619561 · Twitter Post
• https://twitter.com/cybercronai/status/1927979546759897495 · Twitter Post