CVE-2025-24472

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote

Severity
High 8.1
CVSS 3.1
Exploited
Yes — in CISA KEV
Added Mar 18, 2025 · known ransomware use
EPSS
0.072
94.1th percentile
Discovered by
Third party
Vendor advisory field
Published
Feb 11, 2025
Assigned by fortinet

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Weakness: CWE-288

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiOS
  • Fortinet · FortiProxy

Credit

Fortinet is pleased to thank Sonny of watchTowr ( https://watchtowr.com/) for reporting the CSF related vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiOS version 7.0.17 or above Upgrade to FortiProxy version 7.2.13 or above Upgrade to FortiProxy version 7.0.20 or above

Something wrong here?