This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet FortiOS and FortiClient fix 4 vulnerabilities

Fortinet fixes 4 vulnerabilities in FortiOS and FortiClient. The fix has been released for FortiOS in versions 7.4.4, 7.2.8 and 7.0.15, for FortiClient (Windows) in version 7.2.2, and for FortiClient (Mac) in versions 7.4.3 and 7.2.9 [1][2][3][4].

FortiOS - DoS (CVE-2025-47294)
CVSS 5.3 (Medium)

An unauthenticated remote attacker can carry out a DoS attack on the csfd daemon in FortiOS by sending specially crafted requests [1].

The vulnerability is present in product:

  • FortiOS; >=7.2, <7.2.8; >=7.0, <7.0.15;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 13. 5. 2025.

FortiOS - DoS (CVE-2025-47295)
CVSS 3.7 (Low)

An unauthenticated remote attacker can, under certain conditions, carry out a DoS attack on the FGFM daemon in FortiOS by sending specially crafted requests [2].

The vulnerability is present in product:

  • FortiOS; >=7.4, <7.4.3; >=7.2, <7.2.8; >=7.0, <7.0.15;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 13. 5. 2025.

FortiClientWindows - information leak (CVE-2025-24473)
CVSS 3.7 (Low)

An unauthenticated remote attacker can gain unauthorized access to information in FortiClient (Windows). To exploit the vulnerability, the Windows instance must accept connections on port 8053 [3].

The vulnerability is present in product:

  • FortiClientWindows; >=7.2, <7.2.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

More information:

  • CVE-2025-24473 at cve.org, NVD
  • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere at cwe.mitre.org

The vulnerability was publicly disclosed 13. 5. 2025.

FortiClientMac - privilege escalation (CVE-2025-25251)
CVSS 7.8 (High)

An authenticated local attacker can escalate their privileges in FortiClient (Mac) by sending specially crafted XPC messages [4].

The vulnerability is present in product:

  • FortiClientMac; >=7.4, <7.4.3; >=7.2, <7.2.9;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

More information:

The vulnerability was publicly disclosed 13. 5. 2025.

By CESNET, z.s.p.o. Martin Krajči on 29. 5. 2025.

CESNET, z.s.p.o. Logo