CVE-2025-54838: Medium severity Fortinet FortiPortal vulnerability
Published Dec 9, 2025
·Updated
An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.
Affected Software
2 affected components
Fortinet FortiPortal>=7.4.0<=7.4.5
Fortinet FortiPortal>=7.4.0<=7.4.5
Remediation
Information
Upgrade to FortiPortal version 7.4.6 or above
Event History
Dec 9, 2025
CVE Published
via MITRE·05:18 PM
Data Sourced
via MITRE·05:18 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-54838?
CVE-2025-54838 is classified as a moderate severity vulnerability due to its potential impact on device availability.
2
How do I fix CVE-2025-54838?
To fix CVE-2025-54838, update FortiPortal to the latest version beyond 7.4.5.
3
What systems are affected by CVE-2025-54838?
CVE-2025-54838 affects FortiPortal versions 7.4.0 through 7.4.5.
4
What exploit can be used with CVE-2025-54838?
An authenticated attacker can exploit CVE-2025-54838 by sending crafted HTTP requests to reboot a shared FortiGate device.
5
Who discovered CVE-2025-54838?
CVE-2025-54838 was identified and disclosed by Fortinet's security team.