<?xml version="1.0" encoding="UTF-8"?>
<cvrf:cvrfdoc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
    <cvrf:DocumentTitle>Information disclosure through debug features</cvrf:DocumentTitle>
    <cvrf:DocumentType>Fortinet PSIRT Advisories</cvrf:DocumentType>
    <cvrf:DocumentPublisher Type="Vendor">
        <cvrf:ContactDetails>
            Fortinet PSIRT Contact:
            Website: https://fortiguard.fortinet.com/faq/psirt-contact
        </cvrf:ContactDetails>
     </cvrf:DocumentPublisher>
    <cvrf:DocumentTracking>
        <cvrf:Identification>
            <cvrf:ID>FG-IR-25-844</cvrf:ID>
        </cvrf:Identification>
        <cvrf:Status>Final</cvrf:Status>
        <cvrf:Version>1</cvrf:Version>
        <cvrf:RevisionHistory>
            <cvrf:Revision>
                <cvrf:Number>1</cvrf:Number>
                <cvrf:Date>2025-11-18T00:00:00</cvrf:Date>
                <cvrf:Description>Current version</cvrf:Description>
        </cvrf:Revision>
       </cvrf:RevisionHistory>
        <cvrf:InitialReleaseDate>2025-11-18T00:00:00</cvrf:InitialReleaseDate>
        <cvrf:CurrentReleaseDate>2025-11-18T00:00:00</cvrf:CurrentReleaseDate>
    </cvrf:DocumentTracking>
    <cvrf:DocumentNotes>
        <cvrf:Note Title="Summary" Type="Summary" Ordinal="1">
            An active debug code vulnerability [CWE-489] in FortiClientWindows may allow a local attacker to run the application step by step and retrieve the saved VPN user password
        </cvrf:Note>
        <cvrf:Note Title="Description" Type="General" Ordinal="2">
            None
        </cvrf:Note>
        <cvrf:Note Title="Impact" Type="General" Ordinal="3">
            Information disclosure
        </cvrf:Note>
        <cvrf:Note Title="Solutions" Type="General" Ordinal="4">
            None
        </cvrf:Note>
    </cvrf:DocumentNotes>
    <cvrf:Acknowledgments>
        <cvrf:Acknowledgment>
            <cvrf:Description>Fortinet is pleased to thank Chris Elliott and Cameron Stokes from CrowdStrike for reporting this vulnerability under responsible disclosure.</cvrf:Description>
        </cvrf:Acknowledgment>
    </cvrf:Acknowledgments>
    <ProductTree>
        <Branch Name="Fortinet" Type="Vendor">
            <Branch Name="FortiClientWindows" Type="Product Name">
                <Branch Name="7.4.3" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.4.3">FortiClientWindows 7.4.3</FullProductName>
                </Branch>
                <Branch Name="7.4.2" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.4.2">FortiClientWindows 7.4.2</FullProductName>
                </Branch>
                <Branch Name="7.4.1" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.4.1">FortiClientWindows 7.4.1</FullProductName>
                </Branch>
                <Branch Name="7.4.0" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.4.0">FortiClientWindows 7.4.0</FullProductName>
                </Branch>
                <Branch Name="7.2.10" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.10">FortiClientWindows 7.2.10</FullProductName>
                </Branch>
                <Branch Name="7.2.9" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.9">FortiClientWindows 7.2.9</FullProductName>
                </Branch>
                <Branch Name="7.2.8" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.8">FortiClientWindows 7.2.8</FullProductName>
                </Branch>
                <Branch Name="7.2.7" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.7">FortiClientWindows 7.2.7</FullProductName>
                </Branch>
                <Branch Name="7.2.6" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.6">FortiClientWindows 7.2.6</FullProductName>
                </Branch>
                <Branch Name="7.2.5" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.5">FortiClientWindows 7.2.5</FullProductName>
                </Branch>
                <Branch Name="7.2.4" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.4">FortiClientWindows 7.2.4</FullProductName>
                </Branch>
                <Branch Name="7.2.3" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.3">FortiClientWindows 7.2.3</FullProductName>
                </Branch>
                <Branch Name="7.2.2" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.2">FortiClientWindows 7.2.2</FullProductName>
                </Branch>
                <Branch Name="7.2.1" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.1">FortiClientWindows 7.2.1</FullProductName>
                </Branch>
                <Branch Name="7.2.0" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.2.0">FortiClientWindows 7.2.0</FullProductName>
                </Branch>
                <Branch Name="7.0.14" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.14">FortiClientWindows 7.0.14</FullProductName>
                </Branch>
                <Branch Name="7.0.13" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.13">FortiClientWindows 7.0.13</FullProductName>
                </Branch>
                <Branch Name="7.0.12" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.12">FortiClientWindows 7.0.12</FullProductName>
                </Branch>
                <Branch Name="7.0.11" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.11">FortiClientWindows 7.0.11</FullProductName>
                </Branch>
                <Branch Name="7.0.10" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.10">FortiClientWindows 7.0.10</FullProductName>
                </Branch>
                <Branch Name="7.0.9" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.9">FortiClientWindows 7.0.9</FullProductName>
                </Branch>
                <Branch Name="7.0.8" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.8">FortiClientWindows 7.0.8</FullProductName>
                </Branch>
                <Branch Name="7.0.7" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.7">FortiClientWindows 7.0.7</FullProductName>
                </Branch>
                <Branch Name="7.0.6" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.6">FortiClientWindows 7.0.6</FullProductName>
                </Branch>
                <Branch Name="7.0.5" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.5">FortiClientWindows 7.0.5</FullProductName>
                </Branch>
                <Branch Name="7.0.4" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.4">FortiClientWindows 7.0.4</FullProductName>
                </Branch>
                <Branch Name="7.0.3" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.3">FortiClientWindows 7.0.3</FullProductName>
                </Branch>
                <Branch Name="7.0.2" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.2">FortiClientWindows 7.0.2</FullProductName>
                </Branch>
                <Branch Name="7.0.1" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.1">FortiClientWindows 7.0.1</FullProductName>
                </Branch>
                <Branch Name="7.0.0" Type="Product Version">
                    <FullProductName ProductID="FortiClientWindows-7.0.0">FortiClientWindows 7.0.0</FullProductName>
                </Branch>
            </Branch>
        </Branch>
    </ProductTree>
    <Vulnerability Ordinal="1">
        <Title>Information disclosure through debug features</Title>
        <cvrf:CVE>CVE-2025-54660</cvrf:CVE>
        <ProductStatuses>
            <Status Type="Known Affected">
                <ProductID>FortiClientWindows-7.4.3</ProductID>
                <ProductID>FortiClientWindows-7.4.2</ProductID>
                <ProductID>FortiClientWindows-7.4.1</ProductID>
                <ProductID>FortiClientWindows-7.4.0</ProductID>
                <ProductID>FortiClientWindows-7.2.10</ProductID>
                <ProductID>FortiClientWindows-7.2.9</ProductID>
                <ProductID>FortiClientWindows-7.2.8</ProductID>
                <ProductID>FortiClientWindows-7.2.7</ProductID>
                <ProductID>FortiClientWindows-7.2.6</ProductID>
                <ProductID>FortiClientWindows-7.2.5</ProductID>
                <ProductID>FortiClientWindows-7.2.4</ProductID>
                <ProductID>FortiClientWindows-7.2.3</ProductID>
                <ProductID>FortiClientWindows-7.2.2</ProductID>
                <ProductID>FortiClientWindows-7.2.1</ProductID>
                <ProductID>FortiClientWindows-7.2.0</ProductID>
                <ProductID>FortiClientWindows-7.0.14</ProductID>
                <ProductID>FortiClientWindows-7.0.13</ProductID>
                <ProductID>FortiClientWindows-7.0.12</ProductID>
                <ProductID>FortiClientWindows-7.0.11</ProductID>
                <ProductID>FortiClientWindows-7.0.10</ProductID>
                <ProductID>FortiClientWindows-7.0.9</ProductID>
                <ProductID>FortiClientWindows-7.0.8</ProductID>
                <ProductID>FortiClientWindows-7.0.7</ProductID>
                <ProductID>FortiClientWindows-7.0.6</ProductID>
                <ProductID>FortiClientWindows-7.0.5</ProductID>
                <ProductID>FortiClientWindows-7.0.4</ProductID>
                <ProductID>FortiClientWindows-7.0.3</ProductID>
                <ProductID>FortiClientWindows-7.0.2</ProductID>
                <ProductID>FortiClientWindows-7.0.1</ProductID>
                <ProductID>FortiClientWindows-7.0.0</ProductID>
            </Status>
        </ProductStatuses>
        <CVSSScoreSets>
            <ScoreSetV3>
                <BaseScoreV3>4.9</BaseScoreV3>
                <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:W/RC:R</VectorV3>
            </ScoreSetV3>
        </CVSSScoreSets>
        <References Type="Self">
            <Reference>
                <URL>https://fortiguard.fortinet.com/psirt/FG-IR-25-844</URL>
                <Description>Information disclosure through debug features</Description>
            </Reference>Reference>
        </References>
    </Vulnerability>
</cvrf:cvrfdoc>