PT-2025-47357 · Fortinet · Forticlientwindows

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-54660

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiClientWindows versions 7.0.0 through 7.4.3 Fortinet FortiClientWindows version 7.2.0 through 7.2.10

Description A debug code issue exists in FortiClientWindows that could allow a local attacker to execute the application step by step and obtain the stored VPN user password. The issue involves leftover debug code that exposes VPN credentials.

Recommendations FortiClientWindows versions 7.0.0 through 7.4.3 should be updated. FortiClientWindows versions 7.2.0 through 7.2.10 should be updated.

Fix

LPE

Weakness Enumeration

CWE-489

Related Identifiers

BDU:2025-14870

CVE-2025-54660

Affected Products

Forticlientwindows

References · 8

• https://fortiguard.fortinet.com/psirt/FG-IR-25-844 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54660 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14870 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54660 · Security Note
• https://twitter.com/0dayPublishing/status/1990867584116216166 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990887289182941394 · Twitter Post
• https://t.me/CVEtracker/37636 · Telegram Post
• https://twitter.com/CVEnew/status/1991042965939089446 · Twitter Post