CyberCVE

CVE-2025-25255

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, Fo

Severity
Medium 4.8
CVSS 3.1
Exploited
Not listed
EPSS
0.004
36.6th percentile
Discovered by
Third party
Vendor advisory field
Published
Oct 14, 2025
Assigned by fortinet

Description

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.

Weakness: CWE-358

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiOS
  • Fortinet · FortiProxy

Credit

Fortinet is pleased to thank Emanuel Duss from Compass Security for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiOS version 7.6.4 or above Upgrade to FortiProxy version 7.6.4 or above Upgrade to FortiProxy version 7.4.12 or above

References

Something wrong here?