CVE-2025-57716

An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local low privileged user to perform a DLL hijacking attack via placing a malicious DLL to the FortiClient Online Installer installation folder.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-685	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:forticlient::::::windows::*
	cpe:2.3:a:fortinet:forticlient::::::windows::*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de elemento de ruta de búsqueda no controlada [CWE-427] en FortiClient Windows 7.4.0 a 7.4.3, 7.2.0 a 7.2.11, 7.0 todas las versiones puede permitir a un usuario local con pocos privilegios realizar un ataque de secuestro de DLL mediante la colocación de una DLL maliciosa en la carpeta de instalación del Instalador en Línea de FortiClient.

Information

Published : 2025-10-14 16:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-57716

Mitre link : CVE-2025-57716

CVE.ORG link : CVE-2025-57716

JSON object : View

Products Affected

fortinet

forticlient

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-57716", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57716", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-17T03:55:19.193043Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:forticlientwindows:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.14:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.13:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.11:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientwindows:7.0.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiClientWindows", "versions": [{"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.3"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.11"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.14"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-14T16:15:40.113", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-685", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "An Uncontrolled Search Path Element vulnerability [CWE-427] in FortiClient Windows 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, 7.0 all versions may allow a local low privileged user to perform a DLL hijacking attack via placing a malicious DLL to the FortiClient Online Installer installation folder."}, {"lang": "es", "value": "Una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada [CWE-427] en FortiClient Windows 7.4.0 a 7.4.3, 7.2.0 a 7.2.11, 7.0 todas las versiones puede permitir a un usuario local con pocos privilegios realizar un ataque de secuestro de DLL mediante la colocaci\u00f3n de una DLL maliciosa en la carpeta de instalaci\u00f3n del Instalador en L\u00ednea de FortiClient."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "93305AAD-0315-4D4E-92FB-03665C2CB01B", "versionEndExcluding": "7.2.12", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:fortinet:forticlient:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "51121FCA-2CA9-4B4B-A27C-C4729AB797BB", "versionEndExcluding": "7.4.4", "versionStartIncluding": "7.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}