CVE-2025-46775
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all
Severity
Medium 5.2
CVSS 3.1
Exploited
Not listed
EPSS
0.002
5.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
Nov 18, 2025
Assigned by fortinet
Description
A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands.
Weakness: CWE-1295
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiExtender | Routing & Switching | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiExtender
Credit
Internally discovered and reported by David Maciejak of the Fortinet product security team
Vendor remediation
Upgrade to FortiExtender version 7.6.3 or above Upgrade to FortiExtender version 7.4.8 or above