CVE-2025-43892: Information disclosure in Fortinet FortiOS
CVE-2025-43892 is a medium severity buffer over-read vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, and all versions of 7.2. An authenticated remote attacker could exploit this flaw by submitting a specially crafted request, causing the device to return a portion of its memory in the redirect response. This vulnerability leads to information disclosure but does not impact integrity or availability. An official fix is available from Fortinet.
AI Analysis
Technical Summary
This vulnerability in Fortinet FortiOS involves a buffer over-read condition that allows an authenticated remote attacker to retrieve portions of device memory via a crafted request that triggers the redirect response. The affected versions include FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, and all versions of 7.2. The issue results in information disclosure without affecting system integrity or availability. Fortinet has released an official fix addressing this vulnerability.
Potential Impact
An attacker with valid authentication privileges can exploit this vulnerability to disclose information from device memory. The disclosed information could potentially aid further attacks but does not directly compromise system integrity or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available from Fortinet and should be applied to affected FortiOS versions to remediate this vulnerability. Users should upgrade to the fixed versions as per the vendor's guidance.
CVE-2025-43892: Information disclosure in Fortinet FortiOS
Description
CVE-2025-43892 is a medium severity buffer over-read vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, and all versions of 7.2. An authenticated remote attacker could exploit this flaw by submitting a specially crafted request, causing the device to return a portion of its memory in the redirect response. This vulnerability leads to information disclosure but does not impact integrity or availability. An official fix is available from Fortinet.
CVSS v3.1
Score 4.1medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Fortinet FortiOS involves a buffer over-read condition that allows an authenticated remote attacker to retrieve portions of device memory via a crafted request that triggers the redirect response. The affected versions include FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, and all versions of 7.2. The issue results in information disclosure without affecting system integrity or availability. Fortinet has released an official fix addressing this vulnerability.
Potential Impact
An attacker with valid authentication privileges can exploit this vulnerability to disclose information from device memory. The disclosed information could potentially aid further attacks but does not directly compromise system integrity or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
An official fix is available from Fortinet and should be applied to affected FortiOS versions to remediate this vulnerability. Users should upgrade to the fixed versions as per the vendor's guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- fortinet
- Date Reserved
- 2025-04-18T14:46:53.847Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- official-fix
Threat ID: 6a565a3968715ace43c7b59f
Added to database: 07/14/2026, 15:48:09 UTC
Last enriched: 07/14/2026, 16:23:49 UTC
Last updated: 07/15/2026, 03:43:05 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.