PT-2026-2467 · Fortinet · Fortifone

CVE-2025-47855 · Published 2026-01-13 · Updated 2026-01-16

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiFone versions 7.0.0 through 7.0.1 Fortinet FortiFone versions 3.0.13 through 3.0.23

Description An exposure of sensitive information to an unauthorized actor allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests. The issue is related to [CWE-200].

Recommendations Fortinet FortiFone versions 7.0.0 through 7.0.1 should be updated to a newer, secure version. Fortinet FortiFone versions 3.0.13 through 3.0.23 should be updated to a newer, secure version.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-00506

CVE-2025-47855

Affected Products

Fortifone

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-47855 · Security Note
• https://bdu.fstec.ru/vul/2026-00506 · Security Note
• https://twitter.com/RedLegg/status/2012277462957260803 · Twitter Post
• https://twitter.com/CVEnew/status/2011120639730487645 · Twitter Post
• https://twitter.com/CveFindCom/status/2011130996289065021 · Twitter Post
• https://twitter.com/ThreatSynop/status/2011478714455097788 · Twitter Post
• https://twitter.com/ThreatSynop/status/2011383243031925092 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011125934808854607 · Twitter Post
• https://fortiguard.com/psirt/FG-IR-25-260 · Note
• https://fortiguard.fortinet.com/psirt/FG-IR-25-260 · Note
• https://twitter.com/autumn_good_35/status/2011244393806893490 · Twitter Post