CVE-2025-47855
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to o
Severity
Critical 9.3
CVSS 3.1
Exploited
Not listed
EPSS
0.008
52.8th percentile
Discovered by
Not disclosed
Published
Jan 13, 2026
Assigned by fortinet
Description
An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.
Weakness: CWE-200
Affected products
| Vendor | Product | Category | Matched by |
|---|
No product mapping yet — this CVE is pending taxonomy review.
Vendor-reported affected versions (1)
- Fortinet · FortiFone
Vendor remediation
Upgrade to FortiFone version 7.2.0 or above Upgrade to FortiFone version 7.0.2 or above Upgrade to FortiFone version 3.0.24 or above