CVE-2025-54971
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Fortinet FortiADC (versions 7.4.0, 7.2, 7.1, 7.0, and 6.2) contains an exposure of sensitive information to an unauthorized actor vulnerability. An admin with read-only permission may obtain the external resources password via the product logs.
Risk Assessment
An admin with limited privileges can obtain passwords for external resources, potentially leading to unauthorized access to those resources.
Recommendation
Update FortiADC to a patched version and restrict access to product logs to trusted administrators only.
Other vulnerabilities in FortiADC
See all- CVE-2025-58412Medium
Fortinet FortiADC 8.0.0, 7.6.0 through 7.6.3, 7.4 all versions, and 7.2 all versions contain a basic XSS vulnerability due to improper neutralization of script-related HTML tags. An attacker may execute unauthorized code or commands via a crafted URL.
- CVE-2025-48839Medium
An out-of-bounds write vulnerability (CWE-787) in FortiADC 8.0.0, 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.1 all versions, 7.0 all versions, and 6.2 all versions may allow an authenticated attacker to execute arbitrary code via specially crafted HTTP requests.
- CVE-2025-59921Medium
Fortinet FortiADC versions 7.4.0, 7.2.3 and below, 7.1.4 and below, 7.0 all versions, and 6.2 all versions have an exposure of sensitive information to an unauthorized actor vulnerability. An authenticated attacker can obtain sensitive data via crafted HTTP or HTTPS requests.
Original NVD description (English source)
An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, FortiADC 7.0 all versions, FortiADC 6.2 all versions may allow an admin with read-only permission to get the external resources password via the logs of the product
Vulnerability data from NVD (NIST) · CISA KEV · EPSS