PT-2025-41960 · Fortinet · Fortianalyzer

Published 2025-10-14 · Updated 2025-10-16 · CVE-2025-54973

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiAnalyzer versions 7.2.0 through 7.2.10 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.6 Fortinet FortiAnalyzer versions 7.6.0 through 7.6.2 Fortinet FortiAnalyzer versions prior to 7.0.13

Description A race condition exists due to improper synchronization when handling shared resources. This allows an attacker to potentially bypass FortiCloud SSO authorization by sending specially crafted FortiCloud SSO requests during concurrent execution. The issue involves a flaw in how the system manages access control, potentially allowing unauthorized access.

Recommendations FortiAnalyzer versions 7.2.0 through 7.2.10 should be updated to a version later than 7.2.10. FortiAnalyzer versions 7.4.0 through 7.4.6 should be updated to a version later than 7.4.6. FortiAnalyzer versions 7.6.0 through 7.6.2 should be updated to a version later than 7.6.2. FortiAnalyzer versions prior to 7.0.13 should be updated to version 7.0.13 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2025-14856

CVE-2025-54973

Affected Products

Fortianalyzer

References · 6

• https://fortiguard.fortinet.com/psirt/FG-IR-25-198 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14856 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54973 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54973 · Security Note
• https://twitter.com/CVEnew/status/1978932598065041783 · Twitter Post
• https://t.me/CVEtracker/34864 · Telegram Post