CVE-2025-46776
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions,
Severity
Medium 6.3
CVSS 3.1
Exploited
Not listed
EPSS
0.002
4.9th percentile
Discovered by
Not disclosed
Published
Nov 18, 2025
Assigned by fortinet
Description
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to execute arbitrary code or commands via crafted CLI commands.
Weakness: CWE-120
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiExtender | Routing & Switching | cna-assigner |
Vendor-reported affected versions (1)
- Fortinet · FortiExtender
Vendor remediation
Upgrade to FortiExtender version 7.6.3 or above Upgrade to FortiExtender version 7.4.8 or above