EUVD-2025-210467
GHSA-796h-99fj-c83r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-exploitable with low complexity but requires authentication (PR:L); impact is limited to partial memory disclosure with no integrity or availability consequence.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
Lifecycle Timeline
3DescriptionCVE.org
A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.
AnalysisAI
FortiOS across the 7.2, 7.4, and 7.6 release trains leaks portions of device runtime memory to authenticated remote attackers via a buffer over-read in redirect response handling. Exploitation requires valid credentials but no elevated privileges, and proof-of-concept code exists (CVSS temporal E:P). An official vendor fix is confirmed available (RL:O), though unpatched instances of FortiOS 7.2.x, 7.4.0-7.4.8, and 7.6.0-7.6.2 remain at risk of sensitive memory disclosure - a consequential exposure given that FortiOS processes session tokens, credentials, and cryptographic material at runtime.
Technical ContextAI
CWE-126 (Buffer Over-Read) describes a flaw where a read operation extends past the intended buffer boundary, returning adjacent heap or stack memory to the caller. In this case the over-read occurs during redirect response construction in Fortinet FortiOS, the network operating system underpinning Fortinet firewall, UTM, and SD-WAN appliances. When a specially crafted request is submitted, the response handler reads beyond its allocated buffer and includes excess bytes in the HTTP redirect response returned to the requester. The affected CPE is cpe:2.3:a:fortinet:fortios:*:*:*:*:*:*:*:* spanning the 7.2, 7.4, and 7.6 branches. Because FortiOS handles VPN sessions, administrative credentials, IPsec keying material, and policy state in memory, even a limited over-read on this class of appliance carries higher-than-typical data sensitivity compared to equivalent flaws in general-purpose web servers.
RemediationAI
The CVSS temporal metric RL:O confirms an official vendor-released patch exists. Administrators should consult the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/#5944 for the exact patched target versions - specific fixed release numbers (e.g., 7.6.3+, 7.4.9+) were not independently confirmed in the available data and must be taken from the advisory directly. As an immediate compensating control pending patching, restrict FortiOS management interface access to explicitly trusted administrator source IPs using FortiOS trusted host policies; this does not eliminate the vulnerability but limits the authenticated user pool that can reach the vulnerable redirect handler to known-good principals, substantially reducing exposure on internet-facing appliances. Note that trusted host restrictions affect only management plane access and carry no impact on data plane forwarding.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today