CVE-2025-24471
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-07-22
Assigner: Fortinet, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortios | From 7.4.0 (inc) to 7.4.9 (inc) |
| fortinet | fortisase | 25.1.39 |
| fortinet | fortios | From 7.4.0 (inc) to 7.4.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Certificate Validation issue in FortiOS versions 7.6.1 and below, and 7.4.7 and below. It may allow a remote user who is verified via EAP to connect from FortiClient using a revoked certificate, bypassing proper certificate validation.
How can this vulnerability impact me? :
An attacker with a revoked certificate could still connect remotely via FortiClient, potentially leading to unauthorized access or misuse of network resources. This could compromise the integrity of the system by allowing connections that should have been blocked.