What’s Vulnerable › Vulnerabilities
CVE-2025-64471
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-09 · updated 2026-09-25
- Weakness: CWE-836
Description
A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an unauthenticated attacker to use the hash in place of the password to authenticate via crafted HTTP/HTTPS requests
Affected products
- Fortinet FortiWeb: from 7.0.0 through 7.0.11; from 7.2.0 through 7.2.11; from 7.4.0 through 7.4.10; from 7.6.0 through 7.6.4; from 8.0.0 through 8.0.1
References
Get alerted when CVE-2025-64471 or the next vulnerability affects your stack