CVE-2025-25255CWE-358

CVE-2025-25255

Medium · published October 14, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-358 · Improperly Implemented Security Check for Standard
Published
2025-10-14T20:15Z
Affected products (2)
ProductVersionsFixed in
fortinet/fortiproxy≥ 7.0.1, < 7.6.47.6.4
fortinet/fortios≥ 7.6.0, < 7.6.47.6.4
References (1)
https://fortiguard.fortinet.com/psirt/FG-IR-24-372 · [email protected]
EPSS history
Timeline
  • 14 OCT 15:23Z
    An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through…
    cvelistv5