PSIRTHardcoded Encryption Key Used for VPN Saved Passwords
Summary
A Missing Authorization [CWE-862] in FortiClient Windows may allow an authenticated local attacker to decrypt a currently logged in users VPN password via use of an unprotected DLL function.
| Version | Affected | Solution |
|---|---|---|
| FortiClientWindows 7.4 | 7.4.0 through 7.4.2 | Upgrade to 7.4.3 or above |
| FortiClientWindows 7.2 | 7.2 all versions | Migrate to a fixed release |
Acknowledgement
Alex Ghiotto of HackerHood Research GroupTimeline
2026-05-12: Initial publication