FortiPAM Cleartext Storage in Memory (CWE-316) Prior to 1.6.0
CVE-2025-61713 Published on November 18, 2025
A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions may allow an authenticated attacker with read-write admin privileges to the CLI to obtain other administrators' credentials via diagnose commands.
Vulnerability Analysis
CVE-2025-61713 can be exploited with local system access, requires user interaction and user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Cleartext Storage of Sensitive Information in Memory
The application stores sensitive information in cleartext in memory.
Products Associated with CVE-2025-61713
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-61713 are published in Fortinet Fortipam:
Affected Versions
Fortinet FortiPAM:- Version 1.6.0 is affected.
- Version 1.5.0, <= 1.5.1 is affected.
- Version 1.4.0, <= 1.4.3 is affected.
- Version 1.3.0, <= 1.3.1 is affected.
- Version 1.2.0 is affected.
- Version 1.1.0, <= 1.1.2 is affected.
- Version 1.0.0, <= 1.0.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.