CVE-2025-46775

FortiExtender devices expose administrator credentials through debug log messages that can be accessed by authenticated users. This allows someone with basic access to gain full administrative control of the device.

An authenticated attacker can extract administrator credentials from debug logs in affected FortiExtender versions (7.0, 7.2, 7.4.0-7.4.6, 7.6.0-7.6.1) via debug commands. The vulnerability requires valid user authentication as a precondition; successful exploitation results in privilege escalation to administrative level.