What is CVE-2025-24473?

CVE-2025-24473 is a low-severity vulnerability in Fortinet Forticlient, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 3.7/10. Published 2025-05-28.

How severe is CVE-2025-24473?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Fortinet Forticlient

CVE-2025-24473

A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindows 7.0.13 through 7.0.14 may allow an unauthorized remote attacker to view application information via navigation to a hosted webpage, if Windows is configured to accept incoming connections to port 8053 (non-default setup)

EPSS: 0.005 (38.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Fortinet Forticlient
Fortinet Forticlientwindows — versions 7.2.0, 7.0.13

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-24473?: CVE-2025-24473 is a low-severity vulnerability in Fortinet Forticlient, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 3.7/10. Published 2025-05-28.
How severe is CVE-2025-24473?: Low severity. CVSS v3 base score is 3.7 out of 10.