PT-2025-24717 · Fortinet · Fortios

Published 2025-06-10 · Updated 2025-07-22 · CVE-2025-25250

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4 and earlier FortiOS versions 7.0 and earlier FortiOS versions 7.2 and earlier FortiOS versions 7.4.7 and earlier FortiOS version 7.6.0

Description The issue allows an authenticated user to access full SSL-VPN settings via a crafted URL, potentially exposing sensitive information to unauthorized actors.

Recommendations For FortiOS version 7.6.0, update to a version that fixes the Exposure of Sensitive Information to an Unauthorized Actor issue. For FortiOS versions 7.4.7 and earlier, update to a version that fixes the Exposure of Sensitive Information to an Unauthorized Actor issue. For FortiOS versions 7.2 and earlier, update to a version that fixes the Exposure of Sensitive Information to an Unauthorized Actor issue. For FortiOS versions 7.0 and earlier, update to a version that fixes the Exposure of Sensitive Information to an Unauthorized Actor issue. For FortiOS versions 6.4 and earlier, update to a version that fixes the Exposure of Sensitive Information to an Unauthorized Actor issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2025-12652

CVE-2025-25250

Affected Products

Fortios

References · 9

• https://fortiguard.fortinet.com/psirt/FG-IR-24-257 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25250 · Security Note
• https://bdu.fstec.ru/vul/2025-12652 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25250 · Security Note
• https://twitter.com/CVEnew/status/1932512987346338248 · Twitter Post
• https://fortiguard.com/psirt/FG-IR-24-257 · Note
• https://t.me/cveNotify/129858 · Telegram Post
• https://t.me/cvenotify/129858 · Telegram Post