CVE-2025-54822

MEDIUM

FortiOS 7.0.0-7.4.1 and FortiProxy 2.0.0-7.4.8 - Authenticated Improper Authorization via Crafted HTTP/HTTPS Requests

Title source: llm

Description

An improper authorization vulnerability [CWE-285] vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.11, FortiProxy 7.4.0 through 7.4.8, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions allows an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests.

References (1)

Core 1

Core References

Vendor Advisory

https://fortiguard.fortinet.com/psirt/FG-IR-25-684

Scores

CVSS v3 4.3

EPSS 0.0005

EPSS Percentile 16.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-285

Status published

Products (2)

fortinet/fortios 7.0.0 - 7.2.9

fortinet/fortiproxy 2.0.0 - 7.4.9

Published Oct 14, 2025

Tracked Since Feb 18, 2026