CVE-2025-57823

A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-554	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de solicitud directa ('navegación forzada') en Fortinet FortiAuthenticator 6.6.0 hasta 6.6.6, FortiAuthenticator 6.5 todas las versiones, FortiAuthenticator 6.4 todas las versiones, FortiAuthenticator 6.3 todas las versiones puede permitir a un atacante autenticado con al menos permisos de patrocinador leer y descargar registros del dispositivo mediante el acceso a puntos finales específicos.

Information

Published : 2025-12-09 18:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-57823

Mitre link : CVE-2025-57823

CVE.ORG link : CVE-2025-57823

JSON object : View

Products Affected

fortinet

fortiauthenticator

CWE

CWE-425

Direct Request ('Forced Browsing')

{"id": "CVE-2025-57823", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-57823", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T20:21:04.998926Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:a:fortinet:fortiauthenticator:6.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:fortiauthenticator:6.3.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiAuthenticator", "versions": [{"status": "affected", "version": "6.6.0", "versionType": "semver", "lessThanOrEqual": "6.6.6"}, {"status": "affected", "version": "6.5.0", "versionType": "semver", "lessThanOrEqual": "6.5.6"}, {"status": "affected", "version": "6.4.0", "versionType": "semver", "lessThanOrEqual": "6.4.10"}, {"status": "affected", "version": "6.3.0", "versionType": "semver", "lessThanOrEqual": "6.3.4"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-09T18:15:54.480", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-554", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-425"}]}], "descriptions": [{"lang": "en", "value": "A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least sponsor permissions to read and download device logs via accessing specific endpoints"}, {"lang": "es", "value": "Una vulnerabilidad de solicitud directa ('navegaci\u00f3n forzada') en Fortinet FortiAuthenticator 6.6.0 hasta 6.6.6, FortiAuthenticator 6.5 todas las versiones, FortiAuthenticator 6.4 todas las versiones, FortiAuthenticator 6.3 todas las versiones puede permitir a un atacante autenticado con al menos permisos de patrocinador leer y descargar registros del dispositivo mediante el acceso a puntos finales espec\u00edficos."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiauthenticator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8E31FF4-4BA1-4835-91DF-C8DF310BF8E8", "versionEndIncluding": "6.6.6", "versionStartIncluding": "6.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}