CVE-2025-57716: Fortinet FortiClient Privilege Escalation

CVE-2025-57716 Overview

CVE-2025-57716 is an Uncontrolled Search Path Element vulnerability [CWE-427] affecting the FortiClient Online Installer on Windows. The flaw allows a local, low-privileged user to perform a DLL hijacking attack by placing a malicious dynamic-link library (DLL) in the FortiClient Online Installer installation folder. When the installer loads the planted DLL, the attacker's code executes in the context of the installer process. Fortinet published the advisory FG-IR-25-685 covering FortiClient Windows versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and all 7.0 releases.

Critical Impact
A local low-privileged user can achieve arbitrary code execution with high impact to confidentiality, integrity, and availability by planting a malicious DLL in the FortiClient Online Installer directory.

Affected Products

Fortinet FortiClient for Windows 7.4.0 through 7.4.3
Fortinet FortiClient for Windows 7.2.0 through 7.2.11
Fortinet FortiClient for Windows 7.0 (all versions)

Discovery Timeline

2025-10-14 - CVE-2025-57716 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57716

Vulnerability Analysis

The vulnerability is a classic DLL hijacking issue rooted in an uncontrolled search path used by the FortiClient Online Installer. When the installer executes, it loads one or more DLLs from its own installation folder without validating the origin or integrity of those libraries. Windows resolves DLL references using a search order that includes the application directory. If an attacker can write files into that directory, the operating system will load the attacker's DLL in place of, or ahead of, the legitimate module. The attacker's code then runs with the privileges of the process performing the load, which in the case of installers is often elevated during setup operations.

Root Cause

The root cause is improper control of the DLL search path used by the FortiClient Online Installer, categorized as [CWE-427] Uncontrolled Search Path Element. The installer directory permits write access to non-privileged users, enabling planting of arbitrary libraries. The installer does not enforce signed-module validation, absolute path loading, or SetDefaultDllDirectories hardening to restrict library resolution to trusted locations.

Attack Vector

Exploitation requires local access with low privileges and user interaction, since a victim or scheduled process must execute the FortiClient Online Installer after the malicious DLL is dropped. The attacker copies a crafted DLL matching a name the installer attempts to load into the installer's folder. When the installer runs, LoadLibrary resolves the file from the writable directory and executes the attacker's DllMain code. The result is arbitrary code execution and potential privilege escalation if the installer runs with higher rights.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. See the FortiGuard Security Advisory FG-IR-25-685 for vendor-supplied technical details.

Detection Methods for CVE-2025-57716

Indicators of Compromise

Unexpected DLL files appearing in the FortiClient Online Installer directory, particularly libraries not signed by Fortinet.
Newly created or modified DLLs in installer working folders shortly before installer execution.
FortiClient installer processes spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Outbound network connections initiated by the FortiClient installer process to non-Fortinet infrastructure.

Detection Strategies

Monitor file creation events in FortiClient Online Installer directories and alert on writes by non-administrative users.
Inspect DLL load events (Sysmon Event ID 7) for the installer process and flag modules loaded from user-writable paths.
Verify the Authenticode signature of every DLL loaded by FortiClient installer binaries and alert on unsigned or non-Fortinet signers.

Monitoring Recommendations

Enable Sysmon with a configuration that captures FileCreate, ImageLoad, and ProcessCreate events for installer paths.
Forward endpoint telemetry to a centralized log platform and retain installer directory events for retrospective hunting.
Baseline the set of DLLs legitimately loaded by FortiClient installers to detect additions or replacements.

How to Mitigate CVE-2025-57716

Immediate Actions Required

Upgrade FortiClient Windows to the fixed versions listed in Fortinet advisory FG-IR-25-685.
Restrict write permissions on the FortiClient Online Installer folder to administrators only.
Audit endpoints for existing unsigned DLLs in installer directories and remove any unauthorized files.
Run installers from clean, freshly extracted locations rather than persistent user-writable directories.

Patch Information

Fortinet has published fixed builds through the FortiGuard PSIRT. Refer to the FortiGuard Security Advisory FG-IR-25-685 for the specific fixed version numbers per branch and download links. Administrators should deploy patched installers to all Windows endpoints running affected FortiClient releases and confirm version numbers post-upgrade.

Workarounds

Delete the FortiClient Online Installer binary from endpoints once installation is complete to eliminate the vulnerable execution surface.
Apply NTFS access control lists that deny write access to standard users on any directory containing the installer.
Enforce application allowlisting to block execution of unsigned DLLs by installer processes.
Require installers to be launched only from protected administrative locations such as %ProgramFiles% rather than %TEMP% or user profile folders.

bash

# Configuration example: restrict write access on installer folder using icacls
icacls "C:\Path\To\FortiClientOnlineInstaller" /inheritance:r
icacls "C:\Path\To\FortiClientOnlineInstaller" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"