FortiAnalyzer CVE-2025-53845

Exploitation requires network reachability to the FortiAnalyzer OFTP (OFTPS/FortiGate-to-FortiAnalyzer logging protocol, typically TCP/514) service and affected firmware (7.6.0 through 7.6.3, or any version before 7.4.6); the attacker crafts malformed OFTP requests that the improper authentication logic fails to reject. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N confirmed by CVSS). The primary limiting factor is exposure of the OFTP management/logging interface: FortiAnalyzer appliances are normally deployed on internal management networks rather than the public internet, so realistic exposure depends on whether the OFTP port is reachable by the attacker. Impact is also inherently limited to health/status information disclosure or service disruption, not data compromise or code execution.

This is a moderate-severity improper authentication flaw (CWE-287) in Fortinet FortiAnalyzer with a confirmed vendor CVSS of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). The CVSS vector signals a genuinely attractive precondition - network-reachable, low attack complexity, no privileges, and no user interaction - meaning an unauthenticated remote attacker can trigger it against an exposed management appliance. However, the impact is bounded: only low confidentiality (device health/status information disclosure) and low availability (denial of service), with no integrity impact and no scope change, so this is not a code-execution or full-compromise bug. The EPSS score of 0.46% (38th percentile) is low, the CVE is NOT on the CISA KEV list, and no public proof-of-concept was provided in the input - all three exploitation signals are consistent with each other and point to no observed real-world exploitation. The signals are therefore aligned rather than conflicting: easy to reach but low reward. Net assessment - a real but secondary priority. It should be patched promptly on internet- or management-plane-exposed FortiAnalyzer instances because the unauthenticated/low-complexity profile makes it trivially scannable, but it does not warrant emergency out-of-band response given the limited impact and absence of active exploitation evidence.

An attacker with network reachability to a FortiAnalyzer's OFTP service sends crafted OFTP requests that bypass authentication, retrieving device health and status information or crashing the service to cause a denial of service. No public exploit code was identified in the provided data, and no authentication or user interaction is required (PR:N/UI:N). The disclosed information could aid reconnaissance ahead of a larger intrusion.