FortiOS CVE-2025-31514
LOWSeverity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.
AnalysisAI
Sensitive 2FA-related information is written to FortiOS log files and exposed via diagnose commands, allowing a highly privileged attacker with at least read-only administrative access to recover two-factor authentication data. Affected versions span FortiOS 6.4 through 7.6.3 and FortiProxy across all versions per CPE data, representing a wide installed base. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.04% at the 13th percentile reflects minimal real-world exploitation pressure at this time.
Technical ContextAI
FortiOS is Fortinet's proprietary network operating system powering FortiGate appliances, widely deployed as enterprise firewalls, VPN concentrators, and unified threat management platforms. The root cause is CWE-532 (Insertion of Sensitive Information into Log File), a class of vulnerability where the application inadvertently persists security-sensitive data - in this case, 2FA tokens or seeds - in diagnostic logs or exposes them via the built-in diagnose CLI facility. CPE data confirms impact across cpe:2.3:o:fortinet:fortios and cpe:2.3:a:fortinet:fortiproxy, indicating the flaw is present in both the OS-level FortiGate product line and the dedicated FortiProxy web proxy appliances. The Siemens CERT advisory (SSA-864900) indicates downstream impact on Siemens industrial/OT products that embed FortiOS or FortiProxy components, broadening the affected surface beyond Fortinet-branded hardware.
RemediationAI
The primary remediation is to apply vendor-released patches per Fortinet PSIRT advisory FG-IR-24-452 (https://fortiguard.fortinet.com/psirt/FG-IR-24-452). Exact fixed versions are not enumerated in the available input data and must be confirmed directly from the advisory - do not assume a version is fixed without verification. As a compensating control pending patching, restrict access to FortiOS diagnostic facilities and management interfaces to only the minimum required administrative accounts, enforcing the principle of least privilege to reduce the pool of principals who can access logs or execute diagnose commands. Additionally, review and audit which accounts hold read-only or higher administrative privileges on affected appliances, and revoke unnecessary access. For Siemens-embedded deployments, consult Siemens SSA-864900 for product-specific guidance, as patch availability may differ from standalone FortiOS timelines. There are no known workarounds that fully mitigate the log exposure itself without patching.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today