CVE-2025-24473

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindows 7.0.13 through 7.0.14 may allow an unauthorized remote attacker to view application information via navigation to a hosted webpage, if Windows is configured to accept incoming connections to port 8053 (non-default setup)

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: May 28, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-244742.7An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through CVE-2025-244776.7A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.1 CVE-2025-244787.1A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malic CVE-2025-244798.6A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Window CVE-2025-244809.3A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation a CVE-2025-244817.0An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permi CVE-2025-244827.0A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissio CVE-2025-244835.5NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially c CVE-2025-244847.8Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authentic CVE-2025-244857.5A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HT CVE-2025-244867.8Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authentic CVE-2025-244875.3An unauthenticated attacker can infer the existence of usernames in the system by querying an API.