CVE-2025-48418

MEDIUM

Fortinet FortiAnalyzer/FortiManager - Auth Bypass

Title source: llm
STIX 2.1

Description

A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command.

Scores

CVSS v3 6.7
EPSS 0.0010
EPSS Percentile 28.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-912
Status published
Products (5)
fortinet/fortianalyzer 6.4.0 - 7.0.15
fortinet/fortianalyzer_cloud 7.6.2
fortinet/fortianalyzer_cloud 6.4.1 - 7.0.15
fortinet/fortimanager 6.4.0 - 7.0.15
fortinet/fortimanager_cloud 6.4.1 - 7.0.15
Published Mar 10, 2026
Tracked Since Mar 11, 2026