{"id":"CVE-2025-46775","state":"PUBLISHED","title":"A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, F","description":"A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands.","publishedAt":"2025-11-18T17:01:17.364Z","updatedAt":"2026-01-14T09:15:50.464Z","severity":{"score":5.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C","source":"fortinet"},"assigner":"fortinet","products":["Fortinet FortiExtender"],"affected":[{"vendor":"Fortinet","product":"FortiExtender","defaultStatus":"unaffected","versions":[{"version":"7.6.0","status":"affected","lessThanOrEqual":"7.6.1","versionType":"semver"},{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.6","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiextender:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.0:*:*:*:*:*:*:*"]}],"references":["https://fortiguard.fortinet.com/psirt/FG-IR-25-259"],"weaknesses":["CWE-1295"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/46xxx/CVE-2025-46775.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-46775","state":"PUBLISHED","datePublished":"2025-11-18T17:01:17.364Z","dateUpdated":"2026-01-14T09:15:50.464Z","assignerShortName":"fortinet","assignerOrgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateReserved":"2025-04-29T08:42:13.449Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A debug messages revealing unnecessary information vulnerability in Fortinet FortiExtender 7.6.0 through 7.6.1, FortiExtender 7.4.0 through 7.4.6, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated user to obtain administrator credentials via debug log commands."}],"affected":[{"vendor":"Fortinet","product":"FortiExtender","defaultStatus":"unaffected","versions":[{"version":"7.6.0","status":"affected","lessThanOrEqual":"7.6.1","versionType":"semver"},{"version":"7.4.0","status":"affected","lessThanOrEqual":"7.4.6","versionType":"semver"},{"version":"7.2.0","status":"affected","lessThanOrEqual":"7.2.5","versionType":"semver"},{"version":"7.0.0","status":"affected","lessThanOrEqual":"7.0.5","versionType":"semver"}],"cpes":["cpe:2.3:a:fortinet:fortiextender:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.6:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.4.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.2.0:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.5:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.4:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.3:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.2:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.1:*:*:*:*:*:*:*","cpe:2.3:a:fortinet:fortiextender:7.0.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-259","name":"https://fortiguard.fortinet.com/psirt/FG-IR-25-259"}],"metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.2,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1295","lang":"en","description":"Information disclosure","type":"CWE"}]}],"providerMetadata":{"shortName":"fortinet","orgId":"6abe59d8-c742-4dff-8ce8-9b0ca1073da8","dateUpdated":"2026-01-14T09:15:50.464Z"},"solutions":[{"lang":"en","value":"Upgrade to FortiExtender version 7.6.3 or above\nUpgrade to FortiExtender version 7.4.8 or above"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-18T18:33:30.741688Z","id":"CVE-2025-46775","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-11-18T18:33:37.068Z"}}]}}}