BaseFortify

Publication date: 2025-10-14

Last updated on: 2025-10-15

Assigner: Fortinet, Inc.

Description

An improper authentication vulnerability [CWE-287] in Fortinet FortiAnalyzer version 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to obtain information pertaining to the device's health and status, or cause a denial of service via crafted OFTP requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2025-10-15

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-53845

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortianalyzer	From 6.4.0 (inc) to 7.4.7 (exc)
fortinet	fortianalyzer	From 7.6.0 (inc) to 7.6.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3 and before 7.4.6. It allows an unauthenticated attacker to either obtain information about the device's health and status or cause a denial of service by sending specially crafted OFTP requests.

Impact Analysis

The impact of this vulnerability includes unauthorized disclosure of information about the device's health and status, which could aid attackers in further attacks, and the potential to cause a denial of service, disrupting the availability of the affected FortiAnalyzer device.

Hi! I’m here to help you understand CVE-2025-53845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70