CyberCVE

CVE-2025-22252

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may all

Severity
Critical 9
CVSS 3.1
Exploited
Not listed
EPSS
0.009
59.6th percentile
Discovered by
Third party
Vendor advisory field
Published
May 28, 2025
Assigned by fortinet

Description

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

Weakness: CWE-306

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Fortinet FortiSwitch Routing & Switching cna-assigner
Vendor-reported products (3)
  • Fortinet · FortiProxy
  • Fortinet · FortiSwitchManager
  • Fortinet · FortiOS

Credit

Fortinet is pleased to thank Cam B from Vital and NBS Telecom's Matheus Maia for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiProxy version 7.6.2 or above Please upgrade to FortiSwitchManager version 7.2.6 or above Please upgrade to FortiOS version 7.6.1 or above Please upgrade to FortiOS version 7.4.7 or above

References

Something wrong here?