CyberCVE

CVE-2025-55717

A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.

Severity
Low 3.8
CVSS 3.1
Exploited
Not listed
EPSS
0.001
0.2th percentile
Discovered by
Not disclosed
Published
Mar 10, 2026
Assigned by fortinet

Description

A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited by conditions out of the control of the attacker: An admin must log in to the targeted device.

Weakness: CWE-312

Affected products

Vendor Product Category Matched by
Fortinet FortiMail Email Security cna-assigner
Fortinet FortiRecorder Other Products cna-assigner
Fortinet FortiVoice Other Products cna-assigner
Vendor-reported affected versions (3)
  • Fortinet · FortiVoice
  • Fortinet · FortiMail
  • Fortinet · FortiRecorder

Vendor remediation

Upgrade to FortiVoice version 7.2.1 or above Upgrade to FortiVoice version 7.0.7 or above Upgrade to FortiMail version 7.6.3 or above Upgrade to FortiMail version 7.4.5 or above Upgrade to FortiMail version 7.2.8 or above Upgrade to FortiMail version 7.0.9 or above Upgrade to FortiRecorder version 7.2.4 or above

References