CVE-2025-47855

Critical

Published: 13 January 2026

Published

13 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0079 51.5th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-47855 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).

Deeper analysis

CVE-2025-47855 is an exposure of sensitive information vulnerability (CWE-200) affecting Fortinet FortiFone versions 7.0.0 through 7.0.1 and 3.0.13 through 3.0.23. The flaw permits retrieval of device configuration data through specially crafted HTTP or HTTPS requests and carries a CVSS 3.1 score of 9.8.

An unauthenticated remote attacker can exploit the issue over the network without any user interaction or credentials to obtain the full device configuration, resulting in complete loss of confidentiality, integrity, and availability.

The Fortinet advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-260 addresses the issue. The EPSS score remains low with a current value of 0.0119 and a peak of 0.0123, indicating no material increase in observed exploitation interest after disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-2230

Vulnerability details

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.

CWE(s): CWE-200

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1602.002 Network Device Configuration Dump Collection

Adversaries may access network configuration files to collect sensitive data about the device and the network.

attack.mitre.org →

Why these techniques?

CVE enables unauthenticated remote exploitation of a public-facing FortiFone web interface (T1190) to dump network device configuration containing sensitive information (T1602.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0