CVE-2025-54838

MediumCVSS 6.8

Published: 09/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.

Risk Assessment

An authenticated attacker could remotely reboot a shared FortiGate device, causing disruption to network and service availability.

Recommendation

Update FortiPortal to a version newer than 7.4.5 to remove this vulnerability.

Other vulnerabilities in FortiPortal

CVE-2026-49938Medium
Fortinet FortiPortal versions 7.4.0 through 7.4.7, 7.2.0 through 7.2.8, and 7.0.x contain an improper access control vulnerability that may allow an attacker to gain unauthorized access via an unspecified attack vector.

Original NVD description (English source)

An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS