CVE-2025-59669: 
Fortinet FortiWeb 脆弱性の分析と軽減

A use of hard-coded credentials vulnerability (CVE-2025-59669) was discovered in Fortinet FortiWeb's internal redis services. The vulnerability was disclosed on November 18, 2025, affecting FortiWeb versions 7.6.0, 7.4 all versions, 7.2 all versions, and 7.0 all versions. The vulnerability was reported by security researcher Victor Pasman under responsible disclosure (Fortinet PSIRT).

The vulnerability is classified as CWE-798 (Use of Hard-coded Credentials) and received a CVSS v3.1 score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The issue specifically involves hard-coded credentials in the internal redis services of FortiWeb, which could be exploited by an authenticated attacker with shell access to connect to any running redis service (NVD, Fortinet PSIRT).

If exploited, this vulnerability allows an authenticated attacker with shell access to the device to connect to redis service and access its data. This could potentially lead to unauthorized access to sensitive information stored in the redis service (CIS Advisory).

Fortinet has released patches to address this vulnerability. Users of FortiWeb 7.6.0 should upgrade to version 7.6.1 or above. Users of FortiWeb 7.4, 7.2, and 7.0 (all versions) should migrate to a fixed release (Fortinet PSIRT).