Insufficiently protected credentials in FortiExtender - CVE-2025-46775
Published: November 18, 2025
Vulnerability identifier: #VU118601
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-46775
CWE-ID: CWE-522
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to gain access to sensitive information.
The vulnerability exists due to insufficiently protected credentials. An authenticated user can obtain administrator credentials via debug log commands.
Affected software
FortiExtender
How to mitigate CVE-2025-46775
Install update from vendor's website.
FortiExtender - addressed in versions 7.4.8, 7.6.3