CVE-2025-25250: Information Disclosure on SSLVPN endpoint
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.6.1 - Upgrade
Upgrade
FortiSASEto a version that resolves this vulnerability.Fixed in 25.2.a
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25250?
CVE-2025-25250 is classified as a severe vulnerability that allows exposure of sensitive information to unauthorized users.
How do I fix CVE-2025-25250?
To fix CVE-2025-25250, update FortiOS to version 7.6.1 or later, or versions 7.4.8 through 7.4.0.
What is the impact of CVE-2025-25250?
The impact of CVE-2025-25250 includes allowing authenticated users to access full SSL-VPN settings via crafted URLs.
Which versions of FortiOS are affected by CVE-2025-25250?
CVE-2025-25250 affects FortiOS versions prior to 7.6.1, 7.4.8 to 7.4.0, and various earlier versions.
Who is the vendor related to CVE-2025-25250?
The vendor related to CVE-2025-25250 is Fortinet, known for their security products including FortiOS.