Paper/Archive/CVE-2025-49201

CVE-2025-49201

Fortinet FortiPAM — A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all…

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 47.6.476 × 209.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests

Affected

ProductAffectedFixed inSource

FortiPAM1.5.0–CNA

FortiPAM1.4.0 – 1.4.2–CNA

FortiPAM1.3.0 – 1.3.1–CNA

FortiPAM1.2.0–CNA

FortiPAM1.1.0 – 1.1.2–CNA

FortiPAM1.0.0 – 1.0.3–CNA

FortiSwitchManager7.2.0 – 7.2.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

fortinet (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-25-010