CVE-2025-43892: Fortinet FortiProxy Information Disclosure

CVE-2025-43892 Overview

CVE-2025-43892 is a buffer over-read vulnerability [CWE-126] affecting multiple versions of Fortinet FortiOS and FortiProxy. The flaw allows an authenticated remote attacker to leak portions of device memory through the redirect response by submitting a specially crafted HTTP request. Affected releases span FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, and all versions of FortiOS 7.2, 7.0, and 6.4. Successful exploitation exposes confidential in-memory data without impacting integrity or availability.

Critical Impact
Authenticated attackers can extract fragments of FortiOS device memory over the network, potentially exposing session data, configuration values, or other sensitive artifacts held in process memory.

Affected Products

Fortinet FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, and 6.4
Fortinet FortiProxy (see vendor advisory for affected branches)
Deployments exposing the FortiOS administrative or user-facing HTTP interface

Discovery Timeline

2026-07-14 - CVE-2025-43892 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2025-43892

Vulnerability Analysis

The issue is a buffer over-read in FortiOS request handling. When the affected code path builds a redirect (HTTP 3xx) response, it reads beyond the intended bounds of a source buffer and copies adjacent process memory into the outbound response. An authenticated attacker who can reach the HTTP interface can trigger the condition with a crafted request and observe the extra bytes in the returned redirect payload.

The vulnerability is classified under [CWE-126: Buffer Over-read]. Impact is limited to confidentiality: no memory is written, and the process is not destabilized. Leaked bytes may include partial URLs, headers, tokens, or other request-scoped data resident in the daemon's heap.

The EPSS model estimates a low probability of exploitation in the near term, and no public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE.

Root Cause

The redirect response builder does not correctly validate the length of the input used to construct the Location header or associated response body. When the attacker-supplied input violates the expected size or termination assumptions, the routine reads past the source buffer and includes trailing memory in the emitted response.

Attack Vector

Exploitation requires network access to the FortiOS or FortiProxy HTTP interface and valid low-privilege credentials. The attacker submits a specially crafted request designed to trigger the redirect path with malformed length or terminator characteristics. The device responds with a redirect that embeds leaked memory contents in the response headers or body. Repeated requests can be issued to sample memory over time.

No verified public exploit code exists for CVE-2025-43892. Refer to the FortiGuard Security Advisory #5944 for vendor-authoritative technical details.

Detection Methods for CVE-2025-43892

Indicators of Compromise

HTTP 3xx redirect responses from FortiOS containing non-printable bytes, binary content, or unexpectedly long Location headers
Repeated authenticated requests from a single session to endpoints that generate redirects, particularly with malformed path or query components
Unusual volumes of small, similar requests followed by parsing of response headers by an external client

Detection Strategies

Inspect FortiOS HTTP access logs for authenticated sessions issuing large numbers of requests to redirect-producing endpoints in a short time window
Deploy network sensors or a reverse proxy to flag redirect responses whose header or body length exceeds expected bounds for the target endpoint
Correlate low-privilege administrative account activity with anomalous response sizes to surface memory-scraping behavior

Monitoring Recommendations

Enable verbose HTTP logging on FortiOS management and SSL-VPN portals and forward logs to a central SIEM
Alert on authentication events from newly created or rarely used low-privilege accounts followed by high request rates
Track outbound data volumes from device management interfaces to detect sustained memory disclosure attempts

How to Mitigate CVE-2025-43892

Immediate Actions Required

Identify all FortiOS and FortiProxy instances and inventory their current versions against the affected ranges
Upgrade to a fixed release as specified in FortiGuard Security Advisory #5944
Restrict administrative and portal access to trusted management networks using firewall policies and trusted host settings
Rotate credentials, API tokens, and session material that may have been resident in memory during the exposure window

Patch Information

Fortinet has published fixed versions in FortiGuard Security Advisory #5944. Apply the vendor-supplied upgrade for each affected FortiOS and FortiProxy branch. Because FortiOS 6.4, 7.0, and 7.2 are affected in all versions, review the advisory for branch-specific end-of-support guidance and migration paths.

Workarounds

Limit exposure of the FortiOS HTTP administrative interface to management VLANs or VPN-only access until patches are applied
Enforce strong authentication and least privilege for all accounts that can reach redirect-generating endpoints
Enable multi-factor authentication on administrative and SSL-VPN accounts to raise the bar for attackers seeking the required authenticated foothold

bash

# Restrict HTTPS admin access to trusted subnets on FortiOS
config system interface
  edit "port1"
    set allowaccess ping
  next
end

config firewall address
  edit "mgmt-net"
    set subnet 10.10.0.0 255.255.255.0
  next
end

config system admin
  edit "admin"
    set trusthost1 10.10.0.0 255.255.255.0
  next
end