---
cve: "CVE-2025-25250"
severity: "LOW"
cvss: 3.9
epss: "46%"
vendor: "Fortinet"
kev: false
exploited: false
published: "2025-06-10 17:21:16"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-14T09:38:19+02:00"
---

# CVE-2025-25250

> 3.9 LOW

## Beschreibung

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiSASE 25.1.c may allow an authenticated user to access full SSL-VPN settings via crafted URL.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-200** — Exposure of Sensitive Information to an Unauthorized Actor
  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

## Angriffsmuster (CAPEC)

- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-116 — Excavation](https://capec.mitre.org/data/definitions/116.html) _(Severity: Medium)_
- [CAPEC-169 — Footprinting](https://capec.mitre.org/data/definitions/169.html) _(Severity: Very Low)_
- [CAPEC-224 — Fingerprinting](https://capec.mitre.org/data/definitions/224.html) _(Severity: Very Low)_
- [CAPEC-285 — ICMP Echo Request Ping](https://capec.mitre.org/data/definitions/285.html) _(Severity: Low)_
- [CAPEC-287 — TCP SYN Scan](https://capec.mitre.org/data/definitions/287.html) _(Severity: Low)_
- [CAPEC-290 — Enumerate Mail Exchange (MX) Records](https://capec.mitre.org/data/definitions/290.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1217 — Browser Bookmark Discovery](https://attack.mitre.org/techniques/T1217/)
- [T1592 — Gather Victim Host Information](https://attack.mitre.org/techniques/T1592/)
- [T1595 — Active Scanning](https://attack.mitre.org/techniques/T1595/)

## Referenzen

- <https://fortiguard.fortinet.com/psirt/FG-IR-24-257>
- <https://cert-portal.siemens.com/productcert/html/ssa-864900.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2025-25250) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_