CVE-2025-24472

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2025-02-11

Last updated on: 2026-08-05

Assigner: Fortinet, Inc.

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-02-11

Last Modified

2026-08-05

Generated

2026-11-04

AI Q&A

2025-02-11

EPSS Evaluated

2026-11-03

NVD

CVE-2025-24472

Affected Vendors & Products

Vendor	Product	Version / Range
fortinet	fortiproxy	From 7.6.0 (inc) to 7.6.4 (inc)
fortinet	fortios	From 7.4.0 (inc) to 7.4.9 (inc)
fortinet	fortiproxy	From 7.6.0 (inc) to 7.6.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

CVE-2025-24472 is an Authentication Bypass vulnerability affecting FortiOS and FortiProxy versions specified. It allows a remote attacker to gain super-admin privileges by sending specially crafted CSF proxy requests, exploiting the flaw in the authentication mechanism.

Detection Guidance

To detect CVE-2025-24472 on your network or system, you can check for the presence of vulnerable FortiOS and FortiProxy versions (7.0.0 through 7.0.16 and 7.2.0 through 7.2.12, 7.0.0 through 7.0.19). Use the following commands: 1. For FortiOS: `get system status` to check the version. 2. For network scanning: `nmap -p <port> --script http-vuln-cve2025-24472 <target>` to identify if the system is vulnerable.

Impact Analysis

This vulnerability can have a significant impact as it allows unauthorized access to super-admin privileges. An attacker could potentially manipulate system settings, access sensitive data, or disrupt services, leading to data breaches or service outages.

Compliance Impact

The vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under regulations like GDPR and HIPAA. Such breaches could result in legal penalties, loss of customer trust, and significant financial repercussions.

Mitigation Strategies

To mitigate CVE-2025-24472, immediately update FortiOS and FortiProxy to the latest versions that are not affected by this vulnerability. Additionally, restrict access to the management interfaces and monitor logs for any unauthorized access attempts. Consider implementing network segmentation to limit exposure.

Hi! I’m here to help you understand CVE-2025-24472. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...