{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59921", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2025-09-23T12:51:54.672Z", "datePublished": "2025-10-14T15:23:42.754Z", "dateUpdated": "2025-10-14T17:35:30.510Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiADC", "cpes": ["cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "7.4.0", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.3", "status": "affected"}, {"versionType": "semver", "version": "7.1.0", "lessThanOrEqual": "7.1.4", "status": "affected"}, {"versionType": "semver", "version": "7.0.0", "lessThanOrEqual": "7.0.6", "status": "affected"}, {"versionType": "semver", "version": "6.2.0", "lessThanOrEqual": "6.2.6", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-10-14T15:23:42.754Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-200", "description": "Information disclosure", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiADC version 7.4.1 or above\nUpgrade to FortiADC version 7.2.4 or above\nUpgrade to FortiADC version 7.1.5 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-434", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-434"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T17:35:23.426428Z", "id": "CVE-2025-59921", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T17:35:30.510Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59921", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T17:35:23.426428Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T17:35:27.651Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiADC", "versions": [{"status": "affected", "version": "7.4.0"}, {"status": "affected", "version": "7.2.0", "versionType": "semver", "lessThanOrEqual": "7.2.3"}, {"status": "affected", "version": "7.1.0", "versionType": "semver", "lessThanOrEqual": "7.1.4"}, {"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "7.0.6"}, {"status": "affected", "version": "6.2.0", "versionType": "semver", "lessThanOrEqual": "6.2.6"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiADC version 7.4.1 or above\nUpgrade to FortiADC version 7.2.4 or above\nUpgrade to FortiADC version 7.1.5 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-434", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-23-434"}], "descriptions": [{"lang": "en", "value": "An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information disclosure"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2025-10-14T15:23:42.754Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59921", "state": "PUBLISHED", "dateUpdated": "2025-10-14T17:35:30.510Z", "dateReserved": "2025-09-23T12:51:54.672Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2025-10-14T15:23:42.754Z", "assignerShortName": "fortinet"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D24E0A5-DCC9-406E-B9C9-DBA37E728A7B", "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:*:*:*:*:*:*:*:*", "matchCriteriaId": "EEF4EE14-8BCF-425A-9A49-1CF82BD47573", "versionEndExcluding": "7.2.4", "versionStartIncluding": "7.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "7C624CB5-F745-4781-839A-B397EC97590B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiADC version 7.4.0, version 7.2.3 and below, version 7.1.4 and below, 7.0 all versions, 6.2 all versions may allow an authenticated attacker to obtain sensitive data via crafted HTTP or HTTPs requests."}], "id": "CVE-2025-59921", "lastModified": "2025-10-16T14:47:39.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@fortinet.com", "type": "Secondary"}]}, "published": "2025-10-14T16:15:41.200", "references": [{"source": "psirt@fortinet.com", "tags": ["Broken Link"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-434"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "psirt@fortinet.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}