CVE-2025-57741: Fortinet FortiClient Privilege Escalation

CVE-2025-57741 Overview

CVE-2025-57741 is an Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] affecting FortiClient for macOS. The flaw allows a local attacker with low privileges to hijack a LaunchDaemon and execute arbitrary code or commands on the affected system. Fortinet disclosed the issue in security advisory FG-IR-25-664 covering FortiClientMac versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.11, and all 7.0 releases.

Critical Impact
A local attacker can abuse writable LaunchDaemon resources to escalate privileges and run arbitrary commands with elevated rights on macOS endpoints running vulnerable FortiClient builds.

Affected Products

FortiClientMac 7.4.0 through 7.4.3
FortiClientMac 7.2.0 through 7.2.11
FortiClientMac 7.0 (all versions)

Discovery Timeline

2025-10-14 - CVE-2025-57741 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57741

Vulnerability Analysis

The vulnerability stems from FortiClient for macOS assigning insecure permissions to critical resources used by one or more of its LaunchDaemon services. On macOS, LaunchDaemons reside under /Library/LaunchDaemons/ and execute their target binaries as root at boot or on demand. When any file referenced by a privileged LaunchDaemon is writable by a lower-privileged user, that user can replace or modify the file to gain code execution in the daemon's security context.

Exploitation requires local access and low privileges. No user interaction is needed. The impact spans confidentiality, integrity, and availability, and a successful attack yields arbitrary command execution with elevated permissions.

Root Cause

The root cause is improper permission assignment [CWE-732] on FortiClientMac resources loaded by a privileged LaunchDaemon. File or directory permissions grant write access to unprivileged principals on assets that should be restricted to root. This mismatch between the privilege of the executing daemon and the write access on its supporting resources creates the hijacking opportunity.

Attack Vector

A local attacker authenticated on the macOS host locates the writable resource referenced by the FortiClient LaunchDaemon. The attacker replaces the resource with malicious content, then triggers or waits for the daemon to load. The next execution runs the attacker-controlled payload as root, delivering local privilege escalation and persistence. Because the attack path relies solely on file system permissions and native launchd behavior, no memory corruption primitives or network access are required.

Detection Methods for CVE-2025-57741

Indicators of Compromise

Unexpected modifications to FortiClient binaries, scripts, or property list files referenced by entries under /Library/LaunchDaemons/.
New or altered LaunchDaemon.plist files that reference FortiClient paths but point to unfamiliar executables.
FortiClient-associated daemons spawning shells such as bash, zsh, or osascript with unusual command-line arguments.

Detection Strategies

Audit permissions on all files and directories referenced by FortiClient LaunchDaemons and flag any that are writable by non-root users or groups.
Monitor process creation events where the parent is a FortiClient daemon and the child is an interpreter, scripting engine, or unsigned binary.
Compare installed FortiClient file hashes against vendor-published reference values to identify tampered components.

Monitoring Recommendations

Enable macOS Endpoint Security telemetry for ES_EVENT_TYPE_NOTIFY_WRITE and ES_EVENT_TYPE_NOTIFY_EXEC events targeting FortiClient install paths.
Alert on any write to /Library/LaunchDaemons/ by a non-root process.
Track privilege transitions from standard user context to root originating from FortiClient service execution.

How to Mitigate CVE-2025-57741

Immediate Actions Required

Upgrade FortiClientMac to a fixed release per Fortinet advisory FG-IR-25-664.
Inventory macOS endpoints running FortiClient 7.0.x, 7.2.0 through 7.2.11, or 7.4.0 through 7.4.3 and prioritize them for patching.
Restrict local logon rights on systems that cannot be patched immediately to reduce the pool of potential attackers.

Patch Information

Fortinet has published fixed builds and remediation guidance in Fortinet Security Advisory FG-IR-25-664. Administrators should review the advisory for the exact minimum patched versions and upgrade all in-scope endpoints accordingly.

Workarounds

Verify and, where necessary, correct permissions on FortiClient install directories so that only root:wheel retains write access.
Remove standard user membership from any local group that has write access to FortiClient resources or /Library/LaunchDaemons/ entries.
Enforce application allowlisting to prevent unsigned or unexpected binaries from executing under privileged daemon contexts.

bash

# Verify ownership and permissions on FortiClient LaunchDaemon resources
sudo ls -laO /Library/LaunchDaemons/ | grep -i forti
sudo find /Library/Application\ Support/Fortinet -not -user root -o -perm -o+w

# Restore secure ownership if writable resources are found
sudo chown -R root:wheel /Library/Application\ Support/Fortinet
sudo chmod -R go-w /Library/Application\ Support/Fortinet