Is CVE-2025-54821 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54821 being exploited in the wild.

How severe is CVE-2025-54821?

Low severity, with a CVSS score of 1.9, published 18 November 2025.

Which products and versions are affected?

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions; Fortinet Fortipam 1.0 through 1.6.0; Fortinet FortiProxy 7.0 through 7.4 all versions, 7.6.0 through 7.6.3; Siemens Ruggedcom Ape1808 All versions with Fortinet NGFW < V7.6.6.

Is there a fix for CVE-2025-54821?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-54821 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2025-54821?

Check whether you run Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54821: Fortinet FortiOS Improper Privilege Management in CLI

Q: Is there a fix for CVE-2025-54821?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-54821 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2025-54821?

Check whether you run Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54821 · Severity: low · CVSS 1.9 · Published 2025-11-18

A security vulnerability exists in several Fortinet networking and access management products, including FortiOS and FortiProxy. This flaw could allow an administrator who already has high-level access to bypass security restrictions that normally limit which specific computers or networks are allowed to manage the device. While the risk is low because it requires existing administrative credentials, it could allow a malicious insider to perform management tasks from unauthorized locations.

Technologies: Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy, Siemens Ruggedcom Ape1808. Vendors: Fortinet, Siemens.

Quick answers

Is CVE-2025-54821 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54821 being exploited in the wild.
How severe is CVE-2025-54821?: Low severity, with a CVSS score of 1.9, published 18 November 2025.
Which products and versions are affected?: Fortinet FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions; Fortinet Fortipam 1.0 through 1.6.0; Fortinet FortiProxy 7.0 through 7.4 all versions, 7.6.0 through 7.6.3; Siemens Ruggedcom Ape1808 All versions with Fortinet NGFW < V7.6.6.
Is there a fix for CVE-2025-54821?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-54821 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2025-54821?: Check whether you run Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Improper Privilege Management vulnerability (CWE-269) exists in the Command Line Interface (CLI) of multiple Fortinet products. The flaw allows an authenticated user with administrative privileges to bypass 'trusted host' security policies, which are intended to restrict management access to specific IP addresses or ranges. By executing a specially crafted CLI command, an attacker can circumvent these source-based access controls. The vulnerability affects FortiOS (6.4 through 7.6.3), FortiPAM (1.0 through 1.6.0), and FortiProxy (7.0 through 7.6.3). Siemens has also identified impact on RUGGEDCOM APE1808 devices running Fortinet NGFW, recommending an update to version 7.6.6 or later.

Affected products

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions
Fortinet FortiPAM 1.0 through 1.6.0
Fortinet FortiProxy 7.0 through 7.4 all versions, 7.6.0 through 7.6.3
Siemens RUGGEDCOM APE1808 All versions with Fortinet NGFW < V7.6.6

Timeline

2025-11-18: disclosed: Initial publication by Fortinet
2025-11-18: advisory: NVD published date
2025-05-13: advisory: Siemens published related advisory SSA-864900

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.