CVE-2025-53845: fortianalyzer from 6.4.0 (inclusive), before 7.4.7 (exclusive), from 7.6.0 (inclusive), before 7.6.4 (exclusive); +1…

Affected technology

fortianalyzer · from 6.4.0 (inclusive), before 7.4.7 (exclusive)
fortinet

fortianalyzer · from 7.6.0 (inclusive), before 7.6.4 (exclusive)
fortinet

FortiAnalyzer · 7.6.0 through 7.6.3, 7.4.0 through 7.4.6, 7.2.0 through 7.2.11, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15
Fortinet

Description’s affected range: version 7.6.0 through 7.6.3 and before 7.4.6

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can obtain information pertaining to the device's health and status, or cause a denial of service via crafted OFTP requests. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as low; integrity impact as none. NVD’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as low; integrity impact as none.