CVE-2025-31514: Fortinet FortiOS Information Disclosure

CVE-2025-31514 Overview

CVE-2025-31514 is an information disclosure vulnerability affecting Fortinet FortiOS and FortiProxy. The flaw stems from the insertion of sensitive information into log files [CWE-532]. An authenticated attacker with low privileges can retrieve sensitive data by accessing log entries that were not properly sanitized.

The vulnerability affects multiple FortiOS and FortiProxy branches spanning several major versions. Fortinet documented the issue in advisory FG-IR-24-452, and Siemens republished the impact for downstream industrial deployments under SSA-864900.

Critical Impact
An authenticated attacker with network access to a vulnerable FortiOS or FortiProxy device can read sensitive information written to logs, aiding follow-on attacks against firewall infrastructure.

Affected Products

Fortinet FortiOS 6.4 (all versions), 7.0 (all versions), 7.2 (all versions), 7.4 (all versions), and 7.6.0 through 7.6.3
Fortinet FortiProxy 7.0 (all versions), 7.2 (all versions), 7.4.0 through 7.4.13, and 7.6.0 through 7.6.3
Siemens products embedding affected FortiOS/FortiProxy components (see advisory SSA-864900)

Discovery Timeline

2025-10-14 - CVE-2025-31514 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31514

Vulnerability Analysis

The vulnerability is classified under [CWE-532: Insertion of Sensitive Information into Log File]. FortiOS and FortiProxy components write sensitive data to log destinations without applying redaction or access filtering. An authenticated user who can query, download, or view those logs obtains information they would not otherwise be authorized to read.

Exploitation requires network reachability to the management or logging interface and valid low-privileged credentials. No user interaction is required. The impact is limited to confidentiality; integrity and availability of the device are not affected by this issue alone.

In Fortinet perimeter deployments, disclosed content in logs can accelerate reconnaissance against the appliance, adjacent VPN tenants, and administrative workflows. Downstream Siemens industrial deployments inherit the exposure when they embed the affected FortiOS or FortiProxy versions.

Root Cause

The root cause is improper handling of sensitive fields during log generation. Affected subsystems emit values that should be masked, truncated, or restricted to higher-privileged roles. Because the data persists in log storage, retention amplifies exposure over time.

Attack Vector

The attack vector is network based. An authenticated attacker with low privileges queries or exports log data through supported administrative channels. The attacker then extracts sensitive fields recorded during normal device operation.

This vulnerability does not have a public proof-of-concept and is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Fortinet Security Advisory FG-IR-24-452 for vendor-confirmed technical details.

Detection Methods for CVE-2025-31514

Indicators of Compromise

Unexpected access to FortiOS or FortiProxy log stores by low-privileged administrative accounts
Bulk log export or download operations initiated outside of scheduled maintenance windows
Repeated authenticated queries against logging APIs from a single source IP

Detection Strategies

Audit role assignments to identify accounts with log read access that should not require it
Correlate administrative session logs with log-export activity to identify anomalous retrieval patterns
Compare current FortiOS and FortiProxy build numbers against the fixed versions listed in FG-IR-24-452

Monitoring Recommendations

Forward FortiOS and FortiProxy administrative and system logs to a centralized SIEM for retention and correlation
Alert on read access to log objects by accounts that do not normally perform log review
Track configuration changes to logging destinations and syslog forwarding rules

How to Mitigate CVE-2025-31514

Immediate Actions Required

Inventory all FortiOS and FortiProxy deployments and identify instances running the affected versions
Restrict access to log viewing and export functions to accounts that require it for their role
Rotate credentials or secrets that may have appeared in historical log data
Purge or archive log data collected on vulnerable versions once analysis is complete

Patch Information

Apply the fixed builds documented in the Fortinet Security Advisory FG-IR-24-452. Siemens customers should also review the Siemens Product Security Advisory SSA-864900 for guidance specific to embedded deployments. Upgrade FortiOS 7.6 and FortiProxy 7.6 past the 7.6.3 range, and migrate FortiOS 6.4, 7.0, 7.2, and 7.4 branches to a supported fixed release identified by Fortinet.

Workarounds

Limit administrative and logging interface reachability to trusted management networks only
Enforce least-privilege role-based access control for all FortiOS and FortiProxy administrators
Reduce log retention periods on unpatched devices to shrink the window of exposure

bash

# Restrict management access on FortiOS to a trusted subnet
config system interface
  edit "mgmt"
    set allowaccess https ssh
    set trusthost1 10.0.0.0 255.255.255.0
  next
end