FortiClient IOCTL Bypass

FortiClient is a VPN client software used by some organizations to secure remote connections. This vulnerability allows an authenticated local user to execute unauthorized code via the fortips driver, potentially leading to arbitrary memory writes and privilege escalation.

Affected versions: 7.4.3, 7.2.9

1. Upgrade to FortiClient 7.4.4 or above from the official Fortinet website.
2. Immediate mitigations:
3. Restrict network access to your FortiClient instance (firewall it from the public internet)
4. Audit admin account activity for suspicious access patterns
5. Monitor for unauthorized token creation

• Vendor Advisory