CVEvulnerability

CVE-2025-55717

4.0 MEDIUM Published 2026-03-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-03-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.0 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
4.0 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-312

Description

A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited by conditions out of the control of the attacker: An admin must log in to the targeted device.

Affected configurations

• fortinet fortivoice (>= 7.0.0 < 7.0.7) • fortinet fortivoice 7.2.0 • fortinet fortirecorder (>= 6.4.0 < 7.2.4) • fortinet fortimail (>= 7.0.0 < 7.0.9) • fortinet fortimail (>= 7.2.0 < 7.2.8) • fortinet fortimail (>= 7.4.0 < 7.4.5) • fortinet fortimail (>= 7.6.0 < 7.6.3)

Related

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References