CVE-2025-54971

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-686	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de exposición de información sensible a un actor no autorizado en Fortinet FortiADC 7.4.0, FortiADC 7.2 todas las versiones, FortiADC 7.1 todas las versiones, FortiADC 7.0 todas las versiones, FortiADC 6.2 todas las versiones podría permitir a un administrador con permiso de solo lectura obtener la contraseña de los recursos externos a través de los registros del producto.

Information

Published : 2025-11-18 17:16

Updated : 2026-10-18 20:10

NVD link : CVE-2025-54971

Mitre link : CVE-2025-54971

CVE.ORG link : CVE-2025-54971

JSON object : View

Products Affected

fortinet

fortiadc

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2025-54971", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54971", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T14:16:46.116202Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@fortinet.com", "affectedData": [{"cpes": ["cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiADC", "versions": [{"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.8"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.5"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.6"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.6"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-18T17:16:03.680", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-686", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product"}, {"lang": "es", "value": "Una vulnerabilidad de exposici\u00f3n de informaci\u00f3n sensible a un actor no autorizado en Fortinet FortiADC 7.4.0, FortiADC 7.2 todas las versiones, FortiADC 7.1 todas las versiones, FortiADC 7.0 todas las versiones, FortiADC 6.2 todas las versiones podr\u00eda permitir a un administrador con permiso de solo lectura obtener la contrase\u00f1a de los recursos externos a trav\u00e9s de los registros del producto."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31187E7F-51A7-4397-A04A-07F45593E090", "versionEndExcluding": "7.4.3", "versionStartIncluding": "6.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}