CVE-2025-31514

An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command.

Scoring

Severity

LOW

CVSS base score

2.6

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

EPSS probability

0.36%

CWE

CWE-532

Published

2025-10-14

Last modified

2026-08-11

Affected products

• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS

Weakness type

• CWE-532

Related vulnerabilities

• CVE-2026-22778 — vLLM leaks a heap address when PIL throws an error
• CVE-2025-14437 — Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
• CVE-2026-5128 — A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker
• CVE-2025-11008 — CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
• CVE-2026-25813 — PlaciPy Exposes Sensitive Data via Application Logs
• CVE-2026-23493 — Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
• CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
• CVE-2026-49200 — Acer Wave 7 router: Broken Access Control

Markdown version · Browse all CVEs