FortiPortal CVE-2025-54838

Exploitation requires an authenticated, low-privileged session to a FortiPortal instance (PR:L) that manages one or more shared FortiGate devices - the 'shared' multi-tenant/MSSP deployment model is the key precondition, since the attack reboots a FortiGate shared across tenants rather than one the attacker legitimately controls. The attacker then sends crafted HTTP requests that bypass authorization checks. Limiting factors: valid portal credentials are mandatory (no unauthenticated path, PR:L), only FortiPortal versions 7.4.0 through 7.4.5 are affected, and impact is restricted to availability (device reboot / denial of service) with no data disclosure or modification. Single-tenant deployments with no shared FortiGate have substantially reduced exposure.

This is a moderate-severity, availability-only authorization flaw (CWE-863) whose signals consistently point to limited real-world urgency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication (PR:L) to the FortiPortal interface, with impact confined entirely to availability (A:H) - no confidentiality or integrity loss. EPSS corroborates low likelihood of broad exploitation at 0.31% (22nd percentile), it is not listed in CISA KEV, and no public proof-of-concept was provided, so exploitation status is 'no public exploit identified at time of analysis.' These signals do not conflict: a low-CVSS-adjacent, auth-required, availability-only bug with low EPSS and no KEV/POC is a genuine but non-urgent, moderate priority. The one notable nuance is a scope question the vendor resolved as S:U even though the described impact (rebooting a shared FortiGate) lands on a different device than the vulnerable FortiPortal - defenders in multi-tenant/MSSP deployments should treat the cross-tenant availability impact as more significant than the 6.5 score alone implies. Patch is available per Fortinet advisory FG-IR-25-032.

A user who already holds valid low-privilege credentials to a shared FortiPortal instance (e.g., one tenant in a multi-tenant/MSSP deployment) sends a crafted HTTP request that abuses missing authorization checks to issue a reboot command against a FortiGate device shared with or belonging to another tenant. The result is a denial of service - the targeted FortiGate reboots, dropping traffic and security enforcement for its users. No public exploit code is known at time of analysis, and exploitation requires authenticated access, limiting it to insiders or attackers with stolen portal credentials.