High · published November 18, 2025
⚡ A crafty local user could exploit an exposed IOCTL in FortiClient, opening the door to unauthorized code execution. 🔥 Think of this as a well-guarded vault that has a weak back door; only those with the right access can slip through and potentially manipulate what’s inside. In this case, a local user with an active VPN connection is like a trusted employee who knows just the right obscure entry point to access sensitive documents. If successfully exploited, an attacker could run unauthorized code on the system, potentially leading to data breaches, system manipulation, or other malicious activities. This is especially concerning as it requires a valid VPN connection, meaning the attacker is already in the network, making detection more challenging.
Think of this as a well-guarded vault that has a weak back door; only those with the right access can slip through and potentially manipulate what’s inside. In this case, a local user with an active VPN connection is like a trusted employee who knows just the right obscure entry point to access sensitive documents. This vulnerability in Fortinet FortiClient (versions 7.4.0 to 7.4.3 and 7.2.0 to 7.2.9) stems from insufficient access control on an IOCTL interface in the fortips driver, allowing an authenticated local user to execute unauthorized commands despite Windows memory protections.
If successfully exploited, an attacker could run unauthorized code on the system, potentially leading to data breaches, system manipulation, or other malicious activities. This is especially concerning as it requires a valid VPN connection, meaning the attacker is already in the network, making detection more challenging. To mitigate this risk, upgrade FortiClient to versions 7.4.4 or 7.2.10 to close this vulnerability. Additionally, ensure that user permissions are reviewed and limited to only what is necessary, and monitor for any unusual activity related to the fortips driver. You’ve got this! By following the remediation steps, you’ll strengthen your defenses and keep your systems secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fortinet/forticlient | ≥ 7.2.0, < 7.2.10 | 7.2.10 |
| fortinet/forticlient | ≥ 7.4.0, < 7.4.4 | 7.4.4 |