CVE-2025-55717: Fortinet FortiVoice Information Disclosure

CVE-2025-55717 Overview

A cleartext storage of sensitive information vulnerability (CWE-312) has been identified in multiple Fortinet products including FortiMail, FortiRecorder, and FortiVoice. This vulnerability may allow an authenticated malicious administrator to obtain user secrets via CLI commands. While practical exploitability is limited by conditions outside the attacker's control—specifically requiring an admin to log in to the targeted device—the potential for credential exposure makes this a significant security concern for organizations relying on these Fortinet solutions.

Critical Impact

Authenticated administrators can access user secrets stored in cleartext through CLI commands, potentially compromising user credentials and sensitive authentication data.

Affected Products

• Fortinet FortiMail versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, and 7.0.0 through 7.0.8
• Fortinet FortiRecorder versions 7.2.0 through 7.2.3, all 7.0.x versions, and all 6.4.x versions
• Fortinet FortiVoice version 7.2.0 and versions 7.0.0 through 7.0.6

Discovery Timeline

• 2026-03-10 - CVE-2025-55717 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-55717

Vulnerability Analysis

This vulnerability involves the improper handling of sensitive user information within Fortinet's enterprise communication and recording products. The affected systems store sensitive user secrets—such as credentials, tokens, or other authentication material—in cleartext format rather than using proper encryption or secure storage mechanisms. This cleartext data becomes accessible to authenticated administrators through the device's command-line interface (CLI).

The local attack vector requires the adversary to already have administrative privileges on the target system. Additionally, the complexity is elevated due to the requirement that a legitimate admin must actively log in to the device, creating a timing dependency that limits opportunistic exploitation. Despite these constraints, successful exploitation results in high confidentiality impact as the attacker gains access to sensitive user authentication secrets.

Root Cause

The root cause of CVE-2025-55717 lies in the failure to implement proper cryptographic protection for sensitive information at rest. The affected Fortinet products store user secrets in cleartext within their internal data structures or configuration storage, making them directly readable through administrative CLI commands rather than requiring decryption or proper authorization workflows for secret access.

This represents a violation of secure development practices that mandate sensitive data should always be encrypted when stored, with access controls limiting who can decrypt or access the underlying cleartext values even among privileged users.

Attack Vector

The attack vector for this vulnerability is local, requiring the attacker to have authenticated administrative access to the target Fortinet device. The exploitation scenario involves:

1. An attacker gains or possesses valid administrator credentials for the target FortiMail, FortiRecorder, or FortiVoice device
2. The attacker logs in to the device's CLI interface
3. The attacker executes specific CLI commands that expose user secrets stored in cleartext
4. The attacker harvests the exposed credentials for further malicious activities such as lateral movement or account compromise

The vulnerability mechanism involves improper access control around sensitive data retrieval combined with insecure storage practices. Rather than requiring separate authorization or decryption operations to access user secrets, the system makes these values directly available through standard administrative CLI operations. For technical details on the specific commands and affected configurations, refer to the FortiGuard Security Advisory.

Detection Methods for CVE-2025-55717

Indicators of Compromise

• Unusual or excessive CLI login activity from administrator accounts, particularly during off-hours or from unexpected source IP addresses
• Execution of configuration dump or debug commands that may expose stored credentials
• Multiple rapid CLI sessions from the same administrative account that could indicate automated credential harvesting
• Evidence of exported configuration files or credential databases from the affected systems

Detection Strategies

• Implement comprehensive logging for all CLI access and command execution on FortiMail, FortiRecorder, and FortiVoice devices
• Deploy SIEM rules to alert on unusual patterns of administrative CLI access or configuration queries
• Utilize SentinelOne Singularity Platform to monitor for suspicious administrative behavior and potential credential access attempts across Fortinet infrastructure
• Review and audit administrative access logs for any unauthorized or anomalous command execution patterns

Monitoring Recommendations

• Enable verbose logging for administrative sessions on all affected Fortinet products
• Configure alerting for CLI commands that may access or export user credentials or configuration data
• Establish baseline administrative activity patterns and monitor for deviations that could indicate compromise
• Implement session recording for privileged access to Fortinet management interfaces to support forensic analysis

How to Mitigate CVE-2025-55717

Immediate Actions Required

• Review and restrict administrative access to affected FortiMail, FortiRecorder, and FortiVoice devices to only essential personnel
• Audit current administrator accounts and remove unnecessary privileged access
• Implement multi-factor authentication for all administrative access to affected devices
• Consider rotating user credentials that may have been exposed if administrative compromise is suspected

Patch Information

Fortinet has released security updates to address this cleartext storage vulnerability. Organizations should upgrade their affected products to the latest patched versions as specified in the FortiGuard Security Advisory FG-IR-26-080. The patches implement proper encryption for sensitive data storage and restrict access to credential information through CLI commands.

Workarounds

• Limit CLI access to affected devices by restricting management network access and implementing strict firewall rules for administrative interfaces
• Enable and enforce role-based access control (RBAC) to minimize the number of administrators with full device access
• Implement network segmentation to isolate Fortinet management interfaces from general network access
• Deploy privileged access management (PAM) solutions to monitor and control administrative sessions to affected devices

# Example: Restrict management interface access via FortiOS CLI
# Limit admin access to specific trusted IP addresses
config system admin
    edit "admin_user"
        set trusthost1 10.0.0.0/24
        set trusthost2 192.168.1.0/24
    next
end

# Enable strong authentication requirements
config system global
    set admin-maintainer disable
    set admin-https-ssl-versions tlsv1-2 tlsv1-3
end