CVE-2025-43892
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A buffer over-read vulnerability in Fortinet FortiOS allows an authenticated remote attacker to read a portion of device memory by submitting a specially crafted request. The issue affects multiple FortiOS versions from 6.4 to 7.6.3.
Risk Assessment
An attacker could gain access to sensitive data stored in device memory, such as encryption keys, passwords, or other confidential information, potentially leading to network security compromise.
Recommendation
Immediately update FortiOS to a patched version provided by the vendor. In the meantime, restrict management interface access to trusted IP addresses only.
Other vulnerabilities in FortiOS
See all- CVE-2015-7361High
FortiOS version 5.2.3, when configured for High Availability (HA) with the dedicated management interface enabled, does not require authentication for access to the ZebOS shell on this interface. This allows remote attackers to gain shell access via unspecified vectors.
- CVE-2025-68686MediumActively exploited
A vulnerability in Fortinet FortiOS allows a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases. The attack requires prior compromise of the product via another vulnerability at the filesystem level.
- CVE-2025-24472HighActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote unauthenticated attacker, with prior knowledge of upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device if Security Fabric is enabled. The attack is carried out via crafted CSF proxy requests.
- CVE-2024-55591CriticalActively exploited
An authentication bypass vulnerability in FortiOS and FortiProxy using an alternate path or channel. A remote attacker can gain super-admin privileges by sending crafted requests to the Node.js websocket module.
- CVE-2023-42789Critical
An out-of-bounds write vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an attacker to execute unauthorized code or commands via specially crafted HTTP requests.
- CVE-2022-40684CriticalActively exploited
An authentication bypass vulnerability in FortiOS, FortiProxy, and FortiSwitchManager allows an unauthenticated attacker to perform operations on the administrative interface via crafted HTTP or HTTPS requests.
- CVE-2019-5591MediumActively exploited
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- CVE-2020-12812CriticalActively exploited
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- CVE-2019-6693MediumActively exploited
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
- CVE-2026-71408Medium
Fortinet FortiOS versions 7.6.0-7.6.6, 7.4 (all), and 7.2 (all) have a vulnerability of resource allocation without limits or throttling, which may allow an attacker to cause denial of service.
Original NVD description (English source)
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.