CVE-2025-49201CWE-1390

CVE-2025-49201

High · published October 14, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00580 · 46.9th percentile
Weakness
CWE-1390 · Weak Authentication
Published
2025-10-14T20:15Z
Affected products (3)
ProductVersionsFixed in
fortinet/fortipam≥ 1.0.0, < 1.4.31.4.3
fortinet/fortipamall versions—
fortinet/fortiswitchmanager≥ 7.2.0, < 7.2.57.2.5
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-010 · [email protected]
EPSS history
Timeline
  • 14 OCT 15:22Z
    A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM…
    cvelistv5