CVE-2025-53744
An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a
Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.006
45.9th percentile
Discovered by
Not disclosed
Published
Aug 12, 2025
Assigned by fortinet
Description
An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.
Weakness: CWE-266
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiOS | Firewall / NGFW | cna-assigner |
Vendor-reported affected versions (2)
- Fortinet · FortiOS
- Siemens · RUGGEDCOM APE1808
Vendor remediation
Please upgrade to FortiOS version 7.6.3 or above Please upgrade to FortiOS version 7.4.8 or above