{"id":"CVE-2025-24472","kind":"vulnerability","aliases":["CVE-2025-24472"],"related":[],"title":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through…","description":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.","summary":"Fortinet FortiOS and FortiProxy contain an authentication bypass that lets a remote attacker gain super-admin privileges by sending crafted CSF proxy requests. CISA lists it as actively exploited, and the KEV entry notes known ransomware use.","severity":"critical","cvss":8.1,"epss":null,"exploited":true,"exploited_at":"2025-03-18T00:00:00+00:00","products":[{"name":"Fortinet FortiOS and FortiProxy","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.0.20"],"affected":">= 7.0.0, < 7.0.20","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.2.13"],"affected":">= 7.2.0, < 7.2.13","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.0.17"],"affected":">= 7.0.0, < 7.0.17","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortigate","fortios","fortiproxy","infrastructure","ransomware","self-hosted"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Apply the mitigation or patch per Fortinet's vendor advisory; CISA says to discontinue use of the product if mitigations are unavailable. Exact fixed versions: unknown.","status":"open","published_at":"2025-02-11T17:15:34+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:58+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:48:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or patch per Fortinet's vendor advisory; CISA says to discontinue use of the product if mitigations are unavailable. Exact fixed versions: unknown.","reach":"internet","summary":"Fortinet FortiOS and FortiProxy contain an authentication bypass that lets a remote attacker gain super-admin privileges by sending crafted CSF proxy requests. CISA lists it as actively exploited, and the KEV entry notes known ransomware use.","category":"infrastructure","who_cares":["fortios","fortiproxy","fortigate","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker gains super-admin control of the firewall or proxy appliance.","analyst_note":"Find the Fortinet PSIRT advisory and the affected/fixed version list, and confirm whether CSF proxy must be enabled to be exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2572,"output_tokens":389,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':17A,20A '-24472':18A,21A '-288':12A,90C '7.0.0':15A,93C,101C '7.0.16':95C '7.0.19':103C '7.2.0':98C '7.2.12':100C 'activ':69B 'admin':57B,124C 'affect':13A,91C 'allow':105C 'altern':6A,84C 'and':24A 'attack':53B,109C 'authent':2A,47B,80C 'bypass':3A,48B,81C 'channel':9A,87C 'cisa':65B 'contain':45B 'craft':61B,137C 'csf':62B,138C 'cve':16A,19A 'cwe':11A,89C 'devic':117C,129C 'downstream':116C,128C 'enabl':135C 'entri':74B 'exploit':32B,70B 'fabric':133C 'fortig':33B 'fortinet':22A,26A,28A,30A,41B 'fortio':14A,34B,42B,92C 'fortios':23A,31A 'fortiproxi':35B,44B,97C 'fortiproxy':25A,27A,29A 'gain':54B,121C 'host':40B 'infrastructur':36B 'kev':73B 'knowledg':112C 'known':76B 'let':50B 'list':66B 'may':104C 'note':75B 'number':119C 'path':7A,85C 'prior':111C 'privileg':58B,125C 'proxi':63B,139C 'ransomwar':37B,77B 'remot':52B,107C 'request':64B,140C 'secur':132C 'self':39B 'self-host':38B 'send':60B 'serial':118C 'super':56B,123C 'super-admin':55B,122C 'unauthent':108C 'upstream':114C 'use':4A,78B,82C 'via':136C 'vulner':10A,88C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-02-11T17:15:34+00:00","kev":{"dateAdded":"2025-03-18","dueDate":"2025-04-08","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-24472","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-24472","severity":null,"published_at":"2025-03-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-24472","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24472","severity":null,"published_at":"2025-02-11T17:15:34+00:00","modified_at":"2026-08-05T05:16:43+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}