CVE-2025-59921
📋 TL;DR
An authenticated attacker can access sensitive information on vulnerable FortiADC devices by sending specially crafted HTTP/HTTPS requests. This affects FortiADC versions 7.4.0, 7.2.3 and below, 7.1.4 and below, all 7.0 versions, and all 6.2 versions.
💻 Affected Systems
- Fortinet FortiADC
📦 What is this software?
Fortiadc by Fortinet
Fortiadc by Fortinet
Fortiadc by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive configuration data, credentials, or system information leading to further attacks or data exfiltration.
Likely Case
Unauthorized access to sensitive configuration details, potentially enabling reconnaissance for follow-up attacks.
If Mitigated
Limited exposure due to proper access controls and network segmentation, with only non-critical information accessible.
🎯 Exploit Status
Exploitation requires authenticated access and crafted HTTP/HTTPS requests; no public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Fortinet advisory for specific patched versions per release line
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-23-434
Restart Required: No
Instructions:
1. Review Fortinet advisory FG-IR-23-434. 2. Upgrade to patched versions as specified in the advisory. 3. Apply patches via FortiADC management interface or CLI.
🔧 Temporary Workarounds
Restrict Access
allLimit network access to FortiADC management interfaces to trusted IPs only.
config system interface
edit <interface_name>
set allowaccess https ssh
set trust-ip-1 <trusted_ip>
end
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiADC from untrusted networks.
- Enforce strong authentication and monitor for unusual authenticated access patterns.
🔍 How to Verify
Check if Vulnerable:
Check FortiADC version via CLI: get system status, and compare with affected versions list.Check Version:
get system status | grep VersionVerify Fix Applied:
Verify version is updated to a patched release as per Fortinet advisory.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP/HTTPS request patterns from authenticated users
- Access to sensitive data endpoints in logs
Network Indicators:
- Crafted HTTP/HTTPS requests to FortiADC management interfaces
SIEM Query:
source="fortiadc" AND (http_method="POST" OR http_method="GET") AND url_path CONTAINS "/api/" AND user IS NOT NULL