CVE-2025-22251
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-07-25
Assigner: Fortinet, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortios | From 7.4.0 (inc) to 7.4.9 (inc) |
| fortinet | fortios | 7.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-923 | The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper restriction of communication channels to intended endpoints in FortiOS versions 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, and 6.4 all versions. It may allow an unauthenticated attacker to inject unauthorized sessions by sending specially crafted FGSP session synchronization packets.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability could inject unauthorized sessions into the system without authentication, potentially leading to unauthorized access or manipulation of sessions. However, the impact on confidentiality is none, integrity impact is low, and availability impact is none according to the CVSS score.