CVE-2025-53379
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An out-of-bounds read vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.2 and all versions of 6.5 may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.
Risk Assessment
The risk involves potential leakage of confidential data such as passwords or keys without authentication, which could lead to compromise of the entire infrastructure.
Recommendation
It is recommended to immediately upgrade Fortinet FortiAuthenticator to version 6.6.3 or later, and for version 6.5 to version 6.5.4 or later, and implement firewall rules to block unauthorized requests.
Other vulnerabilities in FortiAuthenticator
See all- CVE-2013-6990High
FortiAuthenticator before 3.0 allows remote administrators to gain privileges via the command line interface.
- CVE-2025-59923Low
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, 6.5 all versions, 6.4 all versions, 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the credentials of other administrators' messaging services via crafted requests.
- CVE-2025-57823Low
Fortinet FortiAuthenticator versions 6.6.0 through 6.6.6, and all versions of 6.5, 6.4, 6.3 have a forced browsing vulnerability that allows an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints.
Original NVD description (English source)
A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS