An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve the saved VPN user password

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Fortinet
  • Forticlient
  • Forticlientwindows

Configuration 1 [-]

OR cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*

No data.

References
Link Providers
https://fortiguard.fortinet.com/psirt/FG-IR-25-844 cve-icon cve-icon
History

Thu, 20 Nov 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Fortinet forticlient
CPEs cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*
Vendors & Products Fortinet forticlient

Tue, 18 Nov 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Description An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve the saved VPN user password
First Time appeared Fortinet
Fortinet forticlientwindows
Weaknesses CWE-489
CPEs cpe:2.3:a:fortinet:forticlientwindows:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.14:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet forticlientwindows
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:W/RC:R'}
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published:

Updated: 2025-11-18T19:24:07.223Z

Reserved: 2025-07-28T09:23:38.063Z

Link: CVE-2025-54660

cve-icon Vulnrichment

Updated: 2025-11-18T19:24:04.003Z

cve-icon NVD

Status : Analyzed

Published: 2025-11-18T17:16:03.270

Modified: 2025-11-20T14:35:11.943

Link: CVE-2025-54660

cve-icon Redhat

No data.