CVE-2025-54838: Medium severity Fortinet FortiPortal vulnerability
An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiPortalto a version that resolves this vulnerability.Fixed in 7.4.6
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54838?
CVE-2025-54838 is classified as a moderate severity vulnerability due to its potential impact on device availability.
How do I fix CVE-2025-54838?
To fix CVE-2025-54838, update FortiPortal to the latest version beyond 7.4.5.
What systems are affected by CVE-2025-54838?
CVE-2025-54838 affects FortiPortal versions 7.4.0 through 7.4.5.
What exploit can be used with CVE-2025-54838?
An authenticated attacker can exploit CVE-2025-54838 by sending crafted HTTP requests to reboot a shared FortiGate device.
Who discovered CVE-2025-54838?
CVE-2025-54838 was identified and disclosed by Fortinet's security team.