Cyber Posture

CVE-2025-47855

Critical

Published: 13 January 2026

Published
13 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0123 79.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the software flaw in FortiFone devices that enables unauthenticated attackers to obtain sensitive device configuration via crafted HTTP or HTTPS requests.

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations to block unauthorized logical access to the device configuration exposed by this vulnerability.

SC-7 Boundary Protection good match
prevent

Monitors and controls network communications to the FortiFone management interface, preventing external unauthenticated access required to exploit the CVE.

Security SummaryAI

CVE-2025-47855 is an exposure of sensitive information to an unauthorized actor vulnerability, classified under CWE-200, affecting Fortinet FortiFone devices in versions 7.0.0 through 7.0.1 and 3.0.13 through 3.0.23. Published on January 13, 2026, it enables an unauthenticated attacker to obtain the device configuration through crafted HTTP or HTTPS requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impacts across confidentiality, integrity, and availability.

Any unauthenticated attacker with network access to the affected FortiFone device can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows retrieval of the full device configuration, potentially exposing credentials, network settings, and other sensitive data that could facilitate further compromise, such as lateral movement or privilege escalation within the environment.

For mitigation details, refer to the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-260.

Details

CWE(s)
CWE-200

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1602.002 Network Device Configuration Dump Collection
Adversaries may access network configuration files to collect sensitive data about the device and the network.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing FortiFone web interface (T1190) to dump network device configuration containing sensitive information (T1602.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References