CVE-2025-54971CWE-200CWE-532information-disclosure

CVE-2025-54971

Medium · published November 18, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-532 · Insertion of Sensitive Information into Log File
Published
2025-11-18T22:16Z
Affected products (1)
ProductVersionsFixed in
fortinet/fortiadc≥ 6.2.0, < 7.4.37.4.3
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-25-686 · [email protected]
EPSS history
Timeline
  • 18 NOV 17:01Z
    An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions…
    cvelistv5