UpHeron
All vulnerabilities

Servers and applications

CVE-2025-25250

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.

Severity
Medium 4.3
Published
10 Jun 2025
Last changed
23 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.4.8
Sources
NVD

Affected software

SoftwareAffected versions
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • From 6.4.0 before 7.4.8
  • Version 7.6.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-25250
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-25250