CVEvulnerability
CVE-2025-49201
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2025-10-14
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1390
Description
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests
Affected configurations
• fortinet fortipam (>= 1.0.0 < 1.4.3)
• fortinet fortipam 1.5.0
• fortinet fortiswitchmanager (>= 7.2.0 < 7.2.5)
Related
Weakness · CWE (1)
- CWE-1390 Weak Authentication weakness
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-010 Vendor Advisory