Active Debug Code in FortiClient Windows Exposes Saved VPN Passwords

Successful exploitation allows a local attacker to recover saved VPN user passwords from the affected FortiClient Windows installation. This can lead to compromise of VPN credentials, unauthorized access to remote enterprise networks, account misuse, and follow-on activity using the victim's VPN identity. The primary impact evidenced by the provided information is sensitive credential disclosure rather than direct code execution or privilege escalation.

If immediate patching is not possible, reduce exposure by preventing untrusted local access to affected Windows endpoints, restricting administrative and interactive logon rights, and avoiding storage of VPN passwords in FortiClient where operationally feasible. Monitor for suspicious local access and potential misuse of recovered VPN credentials, and consider credential rotation for users who may have stored VPN passwords on affected systems. Standard endpoint hardening and least-privilege controls will reduce the likelihood of local exploitation.

Upgrade FortiClient Windows to a fixed version released by Fortinet that is not affected by CVE-2025-54660. The provided content states that Fortinet has released patches and recommends immediate updates to affected systems. Organizations should identify endpoints running FortiClient Windows 7.4.0-7.4.3, 7.2.0-7.2.10, and any 7.0 version, and prioritize patching or replacement.