CVE-2025-62631CWE-613

CVE-2025-62631

Medium · published December 9, 2025

CVSS v3.1
5.6
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.6th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2025-12-09T23:16Z
Affected products (1)
ProductVersionsFixed in
fortinet/fortios≥ 6.4.0, < 7.4.17.4.1
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-411 · [email protected]
EPSS history
Timeline
  • 09 DEC 17:18Z
    An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS…
    cvelistv5