PT-2026-2467 · Fortinet · Fortifone

CVE-2025-47855 · Publicado 2026-01-13 · Atualizado 2026-01-16

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiFone versions 7.0.0 through 7.0.1 Fortinet FortiFone versions 3.0.13 through 3.0.23

Description An exposure of sensitive information to an unauthorized actor allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests. The issue is related to [CWE-200].

Recommendations Fortinet FortiFone versions 7.0.0 through 7.0.1 should be updated to a newer, secure version. Fortinet FortiFone versions 3.0.13 through 3.0.23 should be updated to a newer, secure version.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2026-00506

CVE-2025-47855

Produtos afetados

Fortifone

Referências · 11

• https://twitter.com/RedLegg/status/2012277462957260803 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-47855 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011120639730487645 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2011130996289065021 · Publicação no Twitter
• https://twitter.com/ThreatSynop/status/2011478714455097788 · Publicação no Twitter
• https://twitter.com/ThreatSynop/status/2011383243031925092 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2011125934808854607 · Publicação no Twitter
• https://fortiguard.com/psirt/FG-IR-25-260 · Nota
• https://fortiguard.fortinet.com/psirt/FG-IR-25-260 · Nota
• https://bdu.fstec.ru/vul/2026-00506 · Nota de Segurança
• https://twitter.com/autumn_good_35/status/2011244393806893490 · Publicação no Twitter