CVE-2025-24472KEV · OVERDUECWE-288

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

High · published February 11, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.1. It is confirmed in active exploitation. It sits in the 94.3th percentile for exploit probability.

564
days past CISA
deadline
CVSS v3.1
8.1
EPSS
7%
Percentile
94.3
In the wild
Confirmed
What it is

🚨 An unauthenticated attacker can exploit a crafted request to snag super-admin access! This is like using a backdoor key that only the designers knew about! 🔥 Imagine a hotel where anyone with the right room numbers can waltz into the penthouse, bypassing all the security checks. In this case, knowing the serial numbers is like having access to the master guest list, allowing unauthorized entry to the most restricted areas. This vulnerability is absolutely devastating! An attacker could gain full control over downstream devices in your network, allowing them to manipulate settings, siphon off data, or even launch more attacks. It’s high-stakes drama that could lead to catastrophic breaches and loss of sensitive information.

Put simply

Imagine a hotel where anyone with the right room numbers can waltz into the penthouse, bypassing all the security checks. In this case, knowing the serial numbers is like having access to the master guest list, allowing unauthorized entry to the most restricted areas. This authentication bypass vulnerability occurs in FortiOS and FortiProxy due to crafted CSF proxy requests sent by an attacker who knows the serial numbers of the devices involved. When the Security Fabric is enabled, these requests enable unauthorized super-admin privileges without authentication.

What to do

This vulnerability is absolutely devastating! An attacker could gain full control over downstream devices in your network, allowing them to manipulate settings, siphon off data, or even launch more attacks. It’s high-stakes drama that could lead to catastrophic breaches and loss of sensitive information. To mitigate this risk, immediately upgrade to FortiOS versions 7.0.17 and 7.2.13 or later. Review your network configurations and ensure that only authenticated requests are processed. Implement additional monitoring to detect suspicious activity related to these devices. You've got this! Following these steps will help you lock down your security and keep those pesky intruders out! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07235 · 94.3th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2025-02-11T22:15Z
KEV added
2025-03-18 · due 2025-04-08
Affected products (3)
ProductVersionsFixed in
fortinet/fortiproxy≥ 7.0.0, < 7.0.207.0.20
fortinet/fortiproxy≥ 7.2.0, < 7.2.137.2.13
fortinet/fortios≥ 7.0.0, < 7.0.177.0.17
References (2)
EPSS history
Timeline
  • 18 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 8
    kev
  • 11 FEB 16:50Z
    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12…
    cvelistv5