CVE-2025-47855 CRITICAL

CVE-2025-47855

Vendor Fortinet
Product FortiFone
Weakness CWE-200 · Info exposure
Published January 13, 2026
Last update January 14, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

What the vulnerability does

01Description

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.

Key dates

02Disclosure timeline

January 13, 2026 CVE published
January 14, 2026 Record updated