CVE-2025-54660
Fortinet Forticlient 7.0.0 – 7.2.11
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-54660 is a medium-severity Active Debug Code (CWE-489) vulnerability in Fortinet Forticlient. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-198012
Vulnerability Data
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWindows 7.0 all versions may allow a local attacker to run the application step by step and retrieve the saved VPN user password
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires disabling or removing non-essential functions such as active debug code that enables step-through execution and password extraction.
Mandates developer testing and evaluation to identify and eliminate residual debug code before production release of FortiClient.
Requires timely remediation of the known flaw (CWE-489) via patches that remove the active debug capability from affected FortiClient versions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require removal of debug code before release, covering most of this weakness while the control addresses many other development issues.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance catches active debug code before deployment.
Configuration management can disable or remove debug features through hardened baselines.
Secure development life cycle mandates removal of debug code before release.
Secure coding standards explicitly prohibit leaving debug code active in production.
Separation of environments reduces risk of debug code reaching production but does not directly address its removal.
Change management can enforce removal of debug code as part of release gates.