Fortinet FortiOS CVE-2025-54822

Exploitation requires that the FortiOS/FortiProxy device be running in multi-VDOM (virtual domain) mode, since the flaw is cross-VDOM access to static files; on a single-VDOM deployment there are no other VDOMs to reach. The attacker must already hold valid credentials granting at least low-privilege access to the administrative/web interface (PR:L), so this is an authenticated attack, not remote-unauthenticated. The limiting factors are therefore: a non-default multi-VDOM configuration, possession of valid low-privilege credentials, and network reachability of the HTTP/HTTPS management interface; impact is bounded to disclosure of static files (read-only, confidentiality only).

This is a low-to-moderate priority issue, consistent across nearly all signals. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning network-reachable but requiring valid low-privilege authentication (PR:L) and yielding only limited confidentiality impact (C:L) with no integrity or availability effect. EPSS is low at 0.32% (23rd percentile), indicating a low modeled probability of exploitation in the near term. The CVE is NOT on CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. All signals agree this is a genuine Medium-severity information-disclosure flaw rather than a critical remote-code-execution or auth-bypass threat. One caveat: the input Tags label this 'Authentication Bypass,' which conflicts with both the CWE (CWE-285 Improper Authorization) and the CVSS vector (PR:L requires authentication) - this is an authorization/isolation failure by an already-authenticated user, not a bypass of authentication. A secondary nuance: crossing a VDOM boundary is arguably a security-scope change, so Fortinet's S:U assignment is debatable, though the impact remains limited to reading static files.

An attacker with valid low-privilege credentials scoped to one VDOM on a multi-VDOM FortiOS or FortiProxy deployment sends crafted HTTP/HTTPS requests to the management interface to read static files belonging to other VDOMs they should not have access to. No public exploit code is known, and successful exploitation discloses limited information only (confidentiality, no modification).