CVE-2025-62631

MediumCVSS 5.6/10Last modified Oct 14, 2026

Description

An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-62645.5Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usuallyCVE-2025-626418.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.CVE-2025-626428.6The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does notCVE-2025-626438.6The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail mesCVE-2025-626447.7The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal informatioCVE-2025-626459.9The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token witCVE-2025-626467.7The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of converCVE-2025-626475.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be usCVE-2025-626485.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio vCVE-2025-626495.8The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipCVE-2025-62657.2A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allowCVE-2025-626509.9The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnost
CVE-2025-62631: Medium severity, CVSS 5.6 | Vulnix