CVE-2025-54660

MEDIUM4.9

An active debug code vulnerability in Fortinet FortiClientWindows 7

Published Nov 18, 2025

Modified 3 days ago

No fix available

Details

An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve the saved VPN user password

Affected Packages

FortiClient

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

References

ADVISORYhttps://fortiguard.fortinet.com/psirt/FG-IR-25-844 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-54660

Aliases

FG-IR-25-844

CVSS Analysis

CVSS v3.1

4.9

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

4.9/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:W/RC:R

Weakness Type (CWE)

Other

CWE-489

Ecosystems(17)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1809) / Server 2019 Windows 10 (1903)Windows 10 (1909)

Timeline

PublishedNov 18, 2025

ModifiedJan 14, 2026

CVE-2025-54660 | Mondoo Vulnerability Intelligence