CVE-2025-47855
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to o
Severity
Critical 9.3
CVSS 3.1
Exploited
Not listed
EPSS
0.009
57.6th percentile
Discovered by
Vendor
Vendor advisory field
Published
Jan 13, 2026
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiFone | Other Products | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiFone
Credit
Internally discovered and reported by Théo Leleu from Fortinet Product Security team.
Vendor remediation
Upgrade to FortiFone version 7.2.0 or above Upgrade to FortiFone version 7.0.2 or above Upgrade to FortiFone version 3.0.24 or above