CVE-2025-54971 Overview
CVE-2025-54971 is an information exposure vulnerability affecting Fortinet FortiADC application delivery controllers. The flaw allows an authenticated administrator with read-only permissions to recover passwords for external resources through product log files. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and [CWE-532] (Insertion of Sensitive Information into Log File).
An attacker exploiting this issue can harvest credentials used by FortiADC to connect to external services. These credentials may enable lateral movement into backend systems that FortiADC integrates with.
Critical Impact
A read-only administrator can extract plaintext external resource passwords from FortiADC logs, enabling credential theft and potential lateral movement into integrated backend systems.
Affected Products
- Fortinet FortiADC 7.4.0
- Fortinet FortiADC 7.2 (all versions), 7.1 (all versions), 7.0 (all versions)
- Fortinet FortiADC 6.2 (all versions)
Discovery Timeline
- 2025-11-18 - CVE-2025-54971 published to the National Vulnerability Database (NVD)
- 2026-10-18 - Last updated in NVD database
Technical Details for CVE-2025-54971
Vulnerability Analysis
Fortinet FortiADC writes sensitive information to log files without adequate redaction. When the appliance interacts with external resources that require authentication, the associated passwords are recorded in log entries accessible through the administrative interface.
Any administrator account with read-only privileges can view these logs. The issue breaks the principle of least privilege by exposing high-value secrets to a role that is not intended to manage credentials. The attack is authenticated and remote, requiring only valid read-only credentials and network access to the management interface.
The exposed passwords belong to external integrations configured on the FortiADC. Depending on deployment, these may include authentication servers, backend application pools, or monitoring endpoints.
Root Cause
The root cause is improper handling of secrets during log generation. The product fails to mask or omit password values before writing diagnostic or operational data to persistent logs ([CWE-532]). Combined with insufficient access controls on log retrieval ([CWE-200]), this allows unauthorized disclosure to read-only administrators.
Attack Vector
The vector is network-based and requires low-privilege authentication. An attacker with a read-only FortiADC account authenticates to the management plane and queries the logging subsystem. Log entries containing credentials used to reach external resources are returned in cleartext. The attacker can then reuse those credentials against the referenced external systems.
No exploitation code is required. The flaw is reachable through normal administrative log-review workflows. Refer to the Fortinet Security Advisory FG-IR-25-686 for vendor-specific technical details.
Detection Methods for CVE-2025-54971
Indicators of Compromise
- Log file entries on FortiADC appliances containing plaintext passwords adjacent to external resource identifiers or service names.
- Unexpected read-only administrator sessions downloading or exporting large volumes of log data from the FortiADC management interface.
- Authentication events on external backend systems originating from unusual sources using credentials configured on FortiADC.
Detection Strategies
- Review FortiADC audit logs for read-only accounts accessing diagnostic log endpoints or exporting system logs.
- Correlate FortiADC administrative sessions with downstream authentication events against external resources using the same service credentials.
- Hunt for log files containing credential patterns using regular expressions against archived FortiADC logs stored in a central SIEM.
Monitoring Recommendations
- Forward FortiADC administrative and audit logs to a centralized SIEM for continuous monitoring of read-only account activity.
- Alert on anomalous log export operations or repeated access to debug and diagnostic logs by non-administrative accounts.
- Monitor external service accounts configured in FortiADC for authentication from unexpected IP addresses or during off-hours.
How to Mitigate CVE-2025-54971
Immediate Actions Required
- Apply the fixed firmware release referenced in the Fortinet Security Advisory FG-IR-25-686.
- Rotate all external resource passwords configured in FortiADC that may have been exposed through logs.
- Audit all read-only administrator accounts and remove any that are no longer required.
- Purge historical FortiADC log files that may contain exposed credentials after exporting required forensic evidence.
Patch Information
Fortinet has published guidance in advisory FG-IR-25-686. Administrators should consult the advisory to identify the fixed version applicable to their deployed FortiADC branch and upgrade accordingly.
Workarounds
- Restrict management-plane access to FortiADC to a dedicated administrative network and trusted IP ranges.
- Limit the number of read-only accounts and enforce multi-factor authentication for all administrative access.
- Disable or minimize verbose logging for subsystems that interact with external resources until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
