CVE-2025-48418
Last modified
CVE-2025-48418 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command.. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
A hidden functionality vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.3, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2.0 through 7.2.10, FortiAnalyzer 7.0.0 through 7.0.14, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.6.2, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.10, FortiAnalyzer Cloud 7.0.1 through 7.0.14, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.3, FortiManager 7.4.0 through 7.4.7, FortiManager 7.2.0 through 7.2.10, FortiManager 7.0.0 through 7.0.14, FortiManager 6.4 all versions, FortiManager Cloud 7.6.2 through 7.6.3, FortiManager Cloud 7.4.1 through 7.4.7, FortiManager Cloud 7.2.1 through 7.2.10, FortiManager Cloud 7.0.1 through 7.0.14, FortiManager Cloud 6.4 all versions may allow a remote authenticated read-only admin with CLI access to escalate their privilege via use of a hidden command.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortimanager | >= 6.4.0, < 7.0.15 |
| Fortinet | Fortimanager | >= 7.2.0, < 7.2.11 |
| Fortinet | Fortimanager | >= 7.4.0, < 7.4.8 |
| Fortinet | Fortimanager | >= 7.6.0, < 7.6.4 |
| Fortinet | Fortimanager Cloud | >= 6.4.1, < 7.0.15 |
| Fortinet | Fortimanager Cloud | >= 7.2.1, < 7.2.11 |
| Fortinet | Fortimanager Cloud | >= 7.4.1, < 7.4.8 |
| Fortinet | Fortimanager Cloud | >= 7.6.2, < 7.6.4 |
| Fortinet | Fortianalyzer | >= 6.4.0, < 7.0.15 |
| Fortinet | Fortianalyzer | >= 7.2.0, < 7.2.11 |
| Fortinet | Fortianalyzer | >= 7.4.0, < 7.4.8 |
| Fortinet | Fortianalyzer | >= 7.6.0, < 7.6.4 |
| Fortinet | Fortianalyzer Cloud | >= 6.4.1, < 7.0.15 |
| Fortinet | Fortianalyzer Cloud | >= 7.2.1, < 7.2.11 |
| Fortinet | Fortianalyzer Cloud | >= 7.4.1, < 7.4.8 |
| Fortinet | Fortianalyzer Cloud | 7.6.2 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-081Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-48418?
How severe is CVE-2025-48418?
How do I fix CVE-2025-48418?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-4841A vulnerability was found in D-Link DCS-932L 2.18.01 and cla…9.8
- CVE-2025-48413The `/etc/passwd` and `/etc/shadow` files reveal hard-coded …7.7
- CVE-2025-48414There are several scripts in the web interface that are acce…6.5
- CVE-2025-48415A USB backdoor feature can be triggered by attaching a USB d…6.2
- CVE-2025-48416An OpenSSH daemon listens on TCP port 22. There is a hard-co…8.1
- CVE-2025-48417The certificate and private key used for providing transport…6.5
- CVE-2025-48419Rejected reason: Not used
- CVE-2025-4842A vulnerability was found in D-Link DCS-932L 2.18.01. It has…9.8
- CVE-2025-48420Rejected reason: Not used
- CVE-2025-48421Rejected reason: Not used
- CVE-2025-48422Rejected reason: Not used
- CVE-2025-48423Rejected reason: Not used
Are you affected by CVE-2025-48418?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST