Cyber Posture

CVE-2025-47855

Critical

Published: 13 January 2026

Published
13 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0119 79.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47855 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-7 (Boundary Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the software flaw in FortiFone devices that enables unauthenticated attackers to obtain sensitive device configuration via crafted HTTP or HTTPS requests.

prevent

Enforces approved authorizations to block unauthorized logical access to the device configuration exposed by this vulnerability.

prevent

Monitors and controls network communications to the FortiFone management interface, preventing external unauthenticated access required to exploit the CVE.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1602.002 Network Device Configuration Dump Collection
Adversaries may access network configuration files to collect sensitive data about the device and the network.
Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing FortiFone web interface (T1190) to dump network device configuration containing sensitive information (T1602.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.

Deeper analysisAI

CVE-2025-47855 is an exposure of sensitive information to an unauthorized actor vulnerability, classified under CWE-200, affecting Fortinet FortiFone devices in versions 7.0.0 through 7.0.1 and 3.0.13 through 3.0.23. Published on January 13, 2026, it enables an unauthenticated attacker to obtain the device configuration through crafted HTTP or HTTPS requests. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high impacts across confidentiality, integrity, and availability.

Any unauthenticated attacker with network access to the affected FortiFone device can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows retrieval of the full device configuration, potentially exposing credentials, network settings, and other sensitive data that could facilitate further compromise, such as lateral movement or privilege escalation within the environment.

For mitigation details, refer to the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-260.

Details

CWE(s)

CVEs Like This One

CVE-2025-22828Shared CWE-200
CVE-2026-40584Shared CWE-200
CVE-2026-22237Shared CWE-200
CVE-2026-31837Shared CWE-200
CVE-2025-67274Shared CWE-200
CVE-2025-27615Shared CWE-200
CVE-2025-25951Shared CWE-200
CVE-2024-13796Shared CWE-200
CVE-2026-2056Shared CWE-200
CVE-2024-11090Shared CWE-200

References