HIGH🇵🇱 Wersja polska

CVE-2025-47761

CVSS 7.8v3.1pub. 2025-11-18upd. 2025-12-16

An Exposed IOCTL with Insufficient Access Control vulnerability [CWE-782] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.9 may allow an authenticated local user to execute unauthorized code via fortips driver. Success of the attack would require bypassing the Windows memory protections such as Heap integrity and HSP. In addition, it requires a valid and running VPN IPSec connection.

CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Fortinet Forticlient

    APP
    Fortinet
    7.2.0 – 7.2.10 (excl.)7.4.0 – 7.4.4 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
VPN
CWE
References

Related vulnerabilities

CVE-2023-45590CRITICAL9.6PL ✓same product

Code injection w Fortinet FortiClientLinux umożliwiający RCE

CVE-2019-17658CRITICAL9.8PL ✓same product

Unquoted service path w FortiClient Windows — privilege escalation

CVE-2026-24018HIGH7.8same product

A UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, Forti...

CVE-2025-62676HIGH7.1same product

An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fort...

CVE-2025-46373HIGH7.8same product

A Heap-based Buffer Overflow vulnerability [CWE-122] vulnerability in Fortinet FortiClientWindows 7.4.0 throug...