CVE-2025-54821
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-11-20
Assigner: Fortinet, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortiproxy | From 7.0.0 (inc) to 7.6.4 (exc) |
| fortinet | fortipam | From 1.0.0 (inc) to 1.6.1 (exc) |
| fortinet | fortios | From 6.4.0 (inc) to 7.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Privilege Management issue in various versions of Fortinet FortiOS, FortiPAM, and FortiProxy products. It allows an authenticated administrator to bypass the trusted host policy by using a specially crafted CLI command, potentially enabling actions that should be restricted.
How can this vulnerability impact me? :
The vulnerability could allow an authenticated administrator to bypass security controls related to the trusted host policy, potentially leading to unauthorized actions or privilege escalation within the affected Fortinet products. However, the CVSS score indicates a low severity impact with limited scope and impact on confidentiality and availability.