FortiClient is a comprehensive endpoint security solution.
An Information Disclosure vulnerability has been identified in FortiClient which reveals VPN credentials.
FortiClient version 5.6.0 and earlier
QID Detection Logic (authenticated):
Operating System: Windows
The QID checks if the host is vulnerable or not by checking the version of the file “FortiVPNst.exe”. The location of the file is determined via the registry key “HKLM\SOFTWARE\Fortinet\FortiClient” and value “INSTALLDIR”.
Successful exploitation of the vulnerability will allow a user to see VPN authentication credentials of other users (sharing the same workstation) due to improperly secured storage locations.