CVE-2025-25253

An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version

Severity

Medium 6.8

CVSS 3.1

Exploited

Not listed

EPSS

0.001

1.6th percentile

Discovered by

Vendor

Vendor advisory field

Published

Oct 14, 2025

Assigned by fortinet

Description

An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy

Weakness: CWE-297

Affected products

Vendor	Product	Category	Matched by
Fortinet	FortiOS	Firewall / NGFW	cna-assigner
Fortinet	FortiPAM	Identity / IAM / MFA	cna-assigner
Fortinet	FortiProxy	SASE / SSE / Secure Web	cna-assigner

Vendor-reported products (4)

Fortinet · FortiProxy
Fortinet · FortiOS
Fortinet · FortiPAM
Siemens · RUGGEDCOM APE1808

Credit

Internally discovered and reported by John Headley of Fortinet System Engineering team.

Vendor remediation

Upgrade to FortiProxy version 7.6.2 or above Upgrade to FortiProxy version 7.4.9 or above Upgrade to FortiOS version 7.6.3 or above Upgrade to FortiOS version 7.4.9 or above

References

Something wrong here?