PT-2025-47353 · Fortinet · Fortiextender

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-46776

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiExtender versions 7.0 all versions Fortinet FortiExtender versions 7.2 all versions Fortinet FortiExtender versions 7.4.0 through 7.4.6 Fortinet FortiExtender versions 7.6.0 through 7.6.1

Description A buffer copy issue without input size validation exists in Fortinet FortiExtender. This can allow an authenticated user to execute arbitrary code or commands through specifically crafted CLI commands.

Recommendations Update FortiExtender versions prior to 7.0. Update FortiExtender versions prior to 7.2. Update FortiExtender versions prior to 7.4.0 or after 7.4.6. Update FortiExtender versions prior to 7.6.0 or after 7.6.1.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-14868

CVE-2025-46776

Affected Products

Fortiextender

References · 7

• https://bdu.fstec.ru/vul/2025-14868 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46776 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46776 · Vendor Advisory
• https://t.me/CVEtracker/37631 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990897530314293328 · Twitter Post
• https://twitter.com/CVEnew/status/1991042967948189941 · Twitter Post