CVE-2025-57823CWE-425

CVE-2025-57823

Low · published December 9, 2025

CVSS v3.1
2.7
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00231 · 13.2th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2025-12-09T23:15Z
Affected products (1)
ProductVersionsFixed in
fortinet/fortiauthenticator≥ 6.3.0, ≤ 6.6.6—
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-554 · [email protected]
EPSS history
Timeline
  • 09 DEC 17:18Z
    A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator…
    cvelistv5