CVE-2025-24473: fortinet forticlient

Vulnerability summary

CVE-2025-24473 is a medium (CVSS 4.8) vulnerability in fortinet forticlient. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.

Timeline

1. 28-05-2025
   PublishedVulnerability first disclosed.
2. 14-01-2026
   Last modifiedVulnerability information updated.

Description

A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindows 7.0.13 through 7.0.14 may allow an unauthorized remote attacker to view application information via navigation to a hosted webpage, if Windows is configured to accept incoming connections to port 8053 (non-default setup)

• CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereThe product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.