---
title: "FortiOS Info Disclosure (CVE-2025-68686)"
canonical: https://trickest.com/library/fortinet-fortios-info-disclosure-cve-2025-68686
description: "Point hosts at FortiOS and flag CVE-2025-68686 (info disclosure) by version, then confirm with a public /remote/fcnfg GET. Non-destructive. CISA KEV."
---

# FortiOS Info Disclosure (CVE-2025-68686)

## Overview

This workflow finds Fortinet FortiOS and sorts each host by whether its version falls in the CVE-2025-68686 range. FortiOS is the firewall image. CVE-2025-68686 is information disclosure that CISA listed on KEV. A forgotten 7.4 box on a lab VLAN still answers the same login you already know. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints the product from the public page (title match on Forti), reads the version from `/login` with a fallback to the root body, and compares that number to the range table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). CVE-2025-68686 is on CISA KEV (known exploited). Version flag is first. Hosts in range get a second node that only GETs `/remote/fcnfg` for a public leak marker. It does not dump secrets or write files.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as Fortinet FortiOS from the public page title, then GET `/login` and parse the version. A host counts as affected only when the fingerprint matches and the version is inside the encoded range.
3. Confirm only those flagged hosts by GET of `/remote/fcnfg` for a public leak marker.
4. Collect the per-host rows: product match, version, affected flag, confirmed flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, affected, confirmed, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test. Fingerprint is read-only GET. Confirm is a GET of `/remote/fcnfg` for a public leak marker, and only after the version flag.

## Outputs

- **results.jsonl.** One row per host: URL, whether Fortinet FortiOS was detected, the version read, the affected flag, and whether the public leak-marker confirm succeeded.
- **summary.json.** Counts across the list: targets, product hits, affected, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product root, `/login`, and (on flagged hosts only) `/remote/fcnfg`.

## Sample output

The records below are illustrative and do not come from a real run. They show one Fortinet FortiOS host inside the CVE-2025-68686 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://fw-a.example.com", "product_detected": true, "version": "7.4.6", "affected": true, "error": null}
{"target_url": "https://fw-b.example.org", "product_detected": true, "version": "7.4.7", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "error": "not_product"}
```

```json
{"cve": "CVE-2025-68686", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which Fortinet FortiOS versions does this flag?

6.4.0 through 7.4.6, and 7.6.0 through 7.6.1. 7.4.7 and 7.6.2 and later on those lines is the floor the graph treats as not affected. The compare uses the version the product itself served.

### Does a flagged host mean CVE-2025-68686 was exploited?

No. A flagged row is patch-lag against the range table. Confirm only tries to GET `/remote/fcnfg` for a public leak marker. Treat a confirmed row as evidence that path still answers, not as proof someone already used it.

### Is this check safe on production?

Yes. Fingerprint is read-only GET. Confirm is another GET of `/remote/fcnfg`, only on hosts already in range. It does not log in, dump secrets, or write files.

### Does the check need credentials?

No. It fingerprints the public page and reads `/login` the way an external scanner would.

### What is CVE-2025-68686?

Information disclosure in FortiOS. CISA listed it on KEV. This workflow flags by version, then confirms with a public leak-marker GET. It does not dump secrets.

## Related workflows

- [FortiAnalyzer Auth Bypass (CVE-2026-24858)](/library/fortianalyzer-auth-bypass-check-cve-2026-24858). Reach for it when the next Fortinet box is Analyzer or Manager.
- [Quantum Gateway Leak (CVE-2024-24919)](/library/check-quantum-security-gateways-info-disclosure-cve-2024-24919). Reach for it when the next leak flag is a Check Point gateway.
- [Full Network Port and Service Assessment](/library/full-network-port-and-service-assessment). Reach for it when you still need to find which hosts speak the Forti login.

---
_Markdown source of https://trickest.com/library/fortinet-fortios-info-disclosure-cve-2025-68686._