cbcvebase.
CVE-2025-49201
published 2025-10-14

CVE-2025-49201: A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM…

PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.58%
43.5th percentile
A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 through 1.4.2, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.4 allows attacker to execute unauthorized code or commands via specially crafted http requests

Affected

12 ranges
VendorProductVersion rangeFixed in
fortinetfortinet——
fortinetfortipam——
fortinetfortipam——
fortinetfortipam——
fortinetfortipam>= 1.0.0 < 1.4.31.4.3
fortinetfortipam1.0.0 – 1.0.3—
fortinetfortipam1.1.0 – 1.1.2—
fortinetfortipam1.3.0 – 1.3.1—
fortinetfortipam1.4.0 – 1.4.2—
fortinetfortiswitchmanager——
fortinetfortiswitchmanager>= 7.2.0 < 7.2.57.2.5
fortinetfortiswitchmanager7.2.0 – 7.2.4—

Detection & IOCsextracted from sources · hover to see the quote

  • →Monitor for specially crafted HTTP requests targeting FortiPAM and FortiSwitchManager authentication endpoints (WAD/GUI), which may indicate exploitation of weak authentication to execute unauthorized code or commands. ↗
  • →Focus detection on the WAD (Web Application Daemon) and GUI components of FortiPAM and FortiSwitchManager, as the vulnerability is specifically identified in these components. ↗
  • ·Affected FortiPAM versions include 1.5.0, 1.4.0 through 1.4.2, and all versions of 1.3, 1.2, 1.1, and 1.0. FortiSwitchManager versions 7.2.0 through 7.2.4 are also affected. Ensure patching covers all listed version branches. ↗
  • ·The vulnerability is classified as CWE-1390 (Weak Authentication), with a CVSS score of 8.1 (High), indicating a significant risk of unauthorized code/command execution without strong authentication controls. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.