FortiClient Under Fire: CVE-2025-54660 Exposes VPN Passwords to Local Attackers

Overview

A concerning vulnerability, identified as CVE-2025-54660, has been discovered in Fortinet’s FortiClientWindows application. This medium-severity flaw could allow a local attacker to potentially retrieve saved VPN user passwords. The vulnerability stems from active debug code left in the application, allowing for step-by-step execution and data extraction.

Technical Details

CVE-2025-54660 resides in the debug code present in specific versions of FortiClientWindows. The affected versions include:

• FortiClientWindows 7.4.0 through 7.4.3
• FortiClientWindows 7.2.0 through 7.2.10
• FortiClientWindows 7.0 all versions

The active debug code allows a local attacker to run the application in a debugging environment. By stepping through the code execution, an attacker can gain access to the memory locations where VPN user passwords are stored, potentially retrieving them in plaintext or a reversibly encrypted format.

While the specific method of exploitation requires local access to the machine running the vulnerable FortiClientWindows installation, it poses a significant risk to users with sensitive VPN credentials.

CVSS Analysis

The vulnerability has been assigned a CVSS score of 5.5 (MEDIUM). This score reflects the following characteristics:

• Attack Vector (AV): Local (L) – Requires local access to the target system.
• Attack Complexity (AC): Low (L) – Requires minimal effort to exploit.
• Privileges Required (PR): None (N) – No specific privileges are required to exploit the vulnerability.
• User Interaction (UI): None (N) – No user interaction is required to trigger the vulnerability.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality Impact (C): High (H) – Potentially exposes sensitive information (VPN passwords).
• Integrity Impact (I): None (N) – Does not allow modification of data or system configuration.
• Availability Impact (A): None (N) – Does not cause a denial of service.

Possible Impact

The successful exploitation of CVE-2025-54660 can have severe consequences:

• Compromised VPN Credentials: Attackers can obtain VPN usernames and passwords, allowing them to access corporate networks and resources remotely.
• Data Breach: Access to VPN can facilitate data breaches and unauthorized access to sensitive company data.
• Lateral Movement: Once inside the network, attackers can use the compromised VPN connection to move laterally and access other systems.
• Reputational Damage: A successful attack can damage the reputation of both the organization using the vulnerable FortiClientWindows and Fortinet.

Mitigation and Patch Steps

To address this vulnerability, Fortinet has released patched versions of FortiClientWindows. Users are strongly advised to take the following steps:

1. Upgrade FortiClientWindows: Immediately upgrade to a version that is not affected by CVE-2025-54660. Consult Fortinet’s advisory (linked below) for the recommended versions.
2. Monitor for Suspicious Activity: Closely monitor systems running FortiClientWindows for any suspicious activity, such as unauthorized VPN connections or unusual network traffic.
3. Implement Strong Password Policies: Enforce strong password policies for VPN accounts, including password complexity and regular password changes.
4. Enable Multi-Factor Authentication (MFA): Whenever possible, enable MFA for VPN access to add an extra layer of security.

References

Fortinet Advisory FG-IR-25-844
NIST NVD CVE-2025-54660 Entry