Vulnerability record/PUBLISHED/Published Oct 14, 2025 15:23:43 UTC

CVE-2025-31365

An Improper Control of Generation of Code ('Code Injection') vulnerability [CWE-94] in FortiClientMac 7.4.0 through 7.4.3, 7.2.1 through 7.2.8 may allow an unauthenticated attacker to execute arbitrary code on the victim's host via tricking the user into visiting a malicious website.

Base score5.5/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityHighAC

Privileges requiredNonePR

User interactionRequiredUI

ScopeChangedS

Confidentiality impactLowC

Integrity impactLowI

Availability impactLowA

Exploit maturityProof of conceptE

CVSS vector stringCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authorityfortinet

Last updatedNov 3, 2026 22:02:58 UTC

PublishedOct 14, 2025 15:23:43 UTC

ReservedMar 28, 2025 10:49:05 UTC