CVE-2025-31514

A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all

Severity

Low 2.6

CVSS 3.1

Remote, needs privileges or user interaction what this means

Exploited

Not listed

EPSS

0.004

27.6th percentile

Discovered by

Third party

Vendor advisory field

Published

Oct 14, 2025

Assigned by fortinet

Description

A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

Weakness: CWE-532

Affected products

Vendor	Product	Category	Matched by
Fortinet	FortiOS Check your version	Firewall / NGFW	cna-assigner
Fortinet	FortiProxy Check your version	SASE / SSE / Secure Web	cna-assigner

Vendor-reported products (3)

Fortinet · FortiOS
Fortinet · FortiProxy
Siemens · RUGGEDCOM APE1808

Credit

Fortinet is pleased to thank Robert Alexandrino (NetworkRA) from OI S.A. SOC Team for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiProxy version 7.6.4 or above Upgrade to upcoming FortiProxy version 7.4.14 or above Upgrade to FortiOS version 7.6.4 or above

References

Something wrong here?