CVE-2025-31514
published 2025-10-14CVE-2025-31514: A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions…
PriorityP421medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.36%
27.3th percentile
A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortios | — | — |
| fortinet | fortios | >= 6.4.0 < 7.6.4 | 7.6.4 |
| fortinet | fortios | 6.4.0 – 6.4.16 | — |
| fortinet | fortios | 7.0.0 – 7.0.19 | — |
| fortinet | fortios | 7.2.0 – 7.2.13 | — |
| fortinet | fortios | 7.4.0 – 7.4.11 | — |
| fortinet | fortios | 7.6.0 – 7.6.2 | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | >= 7.0.0 < 7.6.4 | 7.6.4 |
| fortinet | fortiproxy | 7.0.0 – 7.0.23 | — |
| fortinet | fortiproxy | 7.2.0 – 7.2.16 | — |
| fortinet | fortiproxy | 7.4.0 – 7.4.13 | — |
| fortinet | fortiproxy | 7.6.0 – 7.6.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
Insertion of Sensitive 2FA Information in logs and debug command
vendor_fortinet·2025-10-14·CVSS 2.7
CVE-2025-31514 [LOW] CWE-532 Insertion of Sensitive 2FA Information in logs and debug command
FG-IR-24-452: Insertion of Sensitive 2FA Information in logs and debug command
An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.
CVEs: CVE-2025-31514
CWEs: CWE-532
CVSS: 2.7 (low)
Affected products: FortiOS, FortiProxy
GHSA
GHSA-54gp-3xh8-g5mg: An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7
ghsa_unreviewed·2025-10-14
CVE-2025-31514 [LOW] CWE-532 GHSA-54gp-3xh8-g5mg: An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7
An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-14
Published