CVE-2025-54821

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54821

1.9 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

A

n Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-545 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

14 Jan 2026, 10:16

Type Values Removed Values Added
Summary (en) An Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command. (en) An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command.

20 Nov 2025, 14:34

Type Values Removed Values Added
First Time Fortinet fortios
Fortinet fortiproxy
Fortinet fortipam
Fortinet
References () https://fortiguard.fortinet.com/psirt/FG-IR-25-545 - () https://fortiguard.fortinet.com/psirt/FG-IR-25-545 - Vendor Advisory
CPE cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

18 Nov 2025, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-18 17:16

Updated : 2026-01-14 10:16

NVD link : CVE-2025-54821

Mitre link : CVE-2025-54821

CVE.ORG link : CVE-2025-54821

JSON object : View

Products Affected

fortinet

CWE
CWE-269

Improper Privilege Management