CVE-2025-64471CWE-836

CVE-2025-64471

Medium · published December 9, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-836 · Use of Password Hash Instead of Password for Authentication
Published
2025-12-09T23:16Z
Affected products (5)
ProductVersionsFixed in
fortinet/fortiweb≥ 7.0.0, ≤ 7.0.11—
fortinet/fortiweb≥ 7.2.0, ≤ 7.2.11—
fortinet/fortiweb≥ 7.4.0, ≤ 7.4.10—
fortinet/fortiweb≥ 7.6.0, ≤ 7.6.4—
fortinet/fortiweb≥ 8.0.0, ≤ 8.0.1—
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-984 · [email protected]
EPSS history
Timeline
  • 09 DEC 17:18Z
    A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0…
    cvelistv5