CVE-2025-55717
A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.
Description
A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, FortiMail 7.2.0 through 7.2.7, FortiMail 7.0.0 through 7.0.8, FortiRecorder 7.2.0 through 7.2.3, FortiRecorder 7.0 all versions, FortiRecorder 6.4 all versions, FortiVoice 7.2.0, FortiVoice 7.0.0 through 7.0.6 may allow an authenticated malicious administrator to obtain user's secrets via CLI commands. Practical exploitability is limited by conditions out of the control of the attacker: An admin must log in to the targeted device.
Weakness: CWE-312
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiMail | Email Security | cna-assigner |
| Fortinet | FortiRecorder | Other Products | cna-assigner |
| Fortinet | FortiVoice | Other Products | cna-assigner |
Vendor-reported products (3)
- Fortinet · FortiVoice
- Fortinet · FortiMail
- Fortinet · FortiRecorder
Credit
Discovered during an independent audit commissioned by Fortinet.
Vendor remediation
Upgrade to FortiVoice version 7.2.1 or above Upgrade to FortiVoice version 7.0.7 or above Upgrade to FortiMail version 7.6.3 or above Upgrade to FortiMail version 7.4.5 or above Upgrade to FortiMail version 7.2.8 or above Upgrade to FortiMail version 7.0.9 or above Upgrade to FortiRecorder version 7.2.4 or above