CVE-2025-54660
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
FortiClientWindows versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.10, and all versions of 7.0 contain active debug code that may allow a local attacker to run the application step by step and retrieve the saved VPN user password.
Risk Assessment
A local attacker could obtain sensitive VPN credentials, potentially leading to unauthorized access to the organization's network.
Recommendation
Update FortiClientWindows to the latest version that removes the active debug code, or apply measures to restrict local access to devices.
Other vulnerabilities in FortiClientWindows
See all- CVE-2026-84386Medium
A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7 and 7.2 all versions may allow attacker to improper access control via an exposed minifilter communication port.
- CVE-2026-44278Low
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2 and FortiClientWindows 7.2 all versions may allow an attacker to disclose information.
- CVE-2025-47761High
An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via the fortips driver. A successful attack requires bypassing Windows memory protections such as Heap integrity and HSP, and an active VPN IPSec connection.
- CVE-2025-46373High
A Heap-based Buffer Overflow vulnerability [CWE-122] in Fortinet FortiClientWindows 7.4.0 through 7.4.3 and 7.2.0 through 7.2.8 may allow an authenticated local IPSec user to execute arbitrary code or commands via "fortips_74.sys". The attacker would need to bypass the Windows heap integrity protections.
Original NVD description (English source)
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve the saved VPN user password
Vulnerability data from NVD (NIST) · CISA KEV · EPSS