PT-2025-50130 · Fortinet · Fortiweb

Published 2025-12-09 · Updated 2025-12-14 · CVE-2025-64471

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 8.0.0 through 8.0.1 Fortinet FortiWeb versions 7.6.0 through 7.6.5 Fortinet FortiWeb versions 7.4.0 through 7.4.10 Fortinet FortiWeb versions 7.2.0 through 7.2.11 Fortinet FortiWeb versions 7.0.0 through 7.0.11

Description The software is susceptible to a flaw where password hashes are used instead of passwords during authentication. This could allow an unauthenticated attacker to authenticate using a crafted HTTP/HTTPS request by substituting the password hash for the actual password.

Recommendations Fortinet FortiWeb versions 8.0.0 through 8.0.1 should be updated. Fortinet FortiWeb versions 7.6.0 through 7.6.5 should be updated. Fortinet FortiWeb versions 7.4.0 through 7.4.10 should be updated. Fortinet FortiWeb versions 7.2.0 through 7.2.11 should be updated. Fortinet FortiWeb versions 7.0.0 through 7.0.11 should be updated.

Fix

Weakness Enumeration

CWE-836

Related Identifiers

CVE-2025-64471

Affected Products

Fortiweb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-64471 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-984 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64471 · Vendor Advisory
• https://twitter.com/CVEnew/status/2000248686140637240 · Twitter Post