CVE-2025-46373
📋 TL;DR
A heap-based buffer overflow vulnerability in Fortinet FortiClient for Windows allows authenticated local IPSec users to execute arbitrary code or commands via the fortips_74.sys driver. This affects FortiClientWindows versions 7.4.0-7.4.3 and 7.2.0-7.2.8. Attackers must bypass Windows heap integrity protections to exploit this vulnerability.
💻 Affected Systems
- Fortinet FortiClientWindows
📦 What is this software?
Forticlient by Fortinet
Forticlient by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining SYSTEM privileges, installing persistent malware, and accessing sensitive data.
Likely Case
Local privilege escalation allowing authenticated IPSec users to execute arbitrary code with elevated privileges.
If Mitigated
Limited impact due to Windows heap protections and requirement for authenticated IPSec access.
🎯 Exploit Status
Exploitation requires bypassing Windows heap integrity protections and authenticated IPSec user access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 7.4.3 and 7.2.8 (check vendor advisory for specific fixed versions)
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-125
Restart Required: Yes
Instructions:
1. Download latest FortiClient version from Fortinet support portal. 2. Uninstall current vulnerable version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Disable IPSec functionality
windowsTemporarily disable IPSec VPN functionality in FortiClient to prevent exploitation
Open FortiClient > VPN > Disable IPSec VPN
Restrict IPSec user access
windowsLimit which users have IPSec VPN access permissions
Configure FortiClient VPN access controls to restrict user permissions
🧯 If You Can't Patch
- Implement strict access controls to limit which users can use IPSec VPN functionality
- Monitor for suspicious activity from authenticated IPSec users and implement enhanced logging
🔍 How to Verify
Check if Vulnerable:
Check FortiClient version in About section or via Control Panel > Programs and FeaturesCheck Version:
wmic product where name="FortiClient" get versionVerify Fix Applied:
Verify installed FortiClient version is above 7.4.3 or 7.2.8 as appropriate📡 Detection & Monitoring
Log Indicators:
- Unusual IPSec connection attempts
- Suspicious driver (fortips_74.sys) activity
- Privilege escalation attempts from IPSec users
Network Indicators:
- Abnormal IPSec traffic patterns
- Unexpected outbound connections from FortiClient systems
SIEM Query:
source="forticlient" AND (event_type="privilege_escalation" OR process_name="fortips_74.sys")