FortiClientMac CVE-2025-57741

Exploitation requires the attacker to already have LOCAL, authenticated low-privileged access to a Mac running an affected FortiClientMac build (7.4.0-7.4.3, 7.2.0-7.2.11, or any 7.0 version) - there is no network vector. The specific prerequisite is an insecurely-permissioned FortiClient LaunchDaemon resource (CWE-732 Incorrect Permission Assignment) that a non-root user can modify, enabling LaunchDaemon hijacking that runs as root on next service start. Limiting factors: no remote reachability, a prior foothold/valid local account is needed (PR:L), the host must run a vulnerable FortiClientMac version, and code executes only when the hijacked daemon is (re)launched - but no user interaction is required (UI:N).

This is a credible but non-urgent local privilege-escalation issue rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: exploitation requires local access and existing low-level privileges (PR:L), after which a LaunchDaemon hijack yields full confidentiality, integrity and availability impact - effectively escalation to root on macOS. The corroborating exploitation signals are weak: EPSS is only 0.13% (2nd percentile), the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis. The low EPSS is fully consistent with a local-only, privilege-dependent flaw, which EPSS models rarely score high because they favor remotely reachable bugs. No signals conflict with each other. One labeling tension worth noting: the input Tags include 'RCE', but AV:L makes this LOCAL code execution / privilege escalation, not remote code execution - treat the RCE tag as misleading. Overall: patch in normal cycles, prioritize on multi-user or shared macOS endpoints, but this is not a drop-everything internet-facing emergency.

A local attacker who already has a standard (non-root) account or code execution on a macOS host running FortiClientMac abuses weak permissions on a FortiClient LaunchDaemon resource to plant or modify a daemon binary/plist. When the daemon next launches (at boot or service restart) it executes the attacker's payload with root privileges, escalating from a low-privileged user to full system control. No public exploit code is referenced, so this would require custom tooling, but the technique (LaunchDaemon hijacking via insecure permissions) is well understood.