CVE-2025-54660
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run th
Severity
Medium 4.9
CVSS 3.1
Exploited
Not listed
EPSS
0.002
4.9th percentile
Discovered by
Third party
Vendor advisory field
Published
Nov 18, 2025
Assigned by fortinet
Description
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve the saved VPN user password
Weakness: CWE-489
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiClient | Endpoint / EDR | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiClientWindows
Credit
Fortinet is pleased to thank Chris Elliott and Cameron Stokes from CrowdStrike for reporting this vulnerability under responsible disclosure.
Vendor remediation
Upgrade to FortiClientWindows version 7.4.4 or above Upgrade to FortiClientWindows version 7.2.11 or above