CVE-2025-53845

MediumCVSS 6.5

Published: 14/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

An improper authentication vulnerability (CWE-287) in Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to obtain device health and status information or cause a denial of service via crafted OFTP requests.

Risk Assessment

An attacker can obtain device health and status information or cause a denial of service, potentially disrupting monitoring and log analysis. Lack of authentication facilitates the attack.

Recommendation

Update FortiAnalyzer to the latest version (7.6.4 or 7.4.7) and restrict access to the OFTP service from untrusted networks.

Other vulnerabilities in Fortinet FortiAnalyzer

CVE-2024-40593Medium
A key management errors vulnerability in Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiPortal may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.

Original NVD description (English source)

An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to obtain information pertaining to the device's health and status, or cause a denial of service via crafted OFTP requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS