{"id":"CVE-2025-61624","kind":"vulnerability","aliases":["CVE-2025-61624"],"related":[],"title":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet…","description":"An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.","summary":"FortiOS, FortiPAM, FortiProxy and FortiSwitchManager have a path traversal flaw in specific CLI commands. An authenticated admin with read-write permissions can write or delete arbitrary files on the device, and the flaw is exploited in the wild.","severity":"high","cvss":6.5,"epss":null,"exploited":true,"exploited_at":"2026-10-16T00:00:00+00:00","products":[{"name":"Fortinet Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"FortiOS","fixed":["7.4.10","7.6.5"],"affected":"6.4 all, 7.0 all, 7.2 all, 7.4.0 - 7.4.9, 7.6.0 - 7.6.4","ecosystem":"vendor"},{"name":"FortiPAM","fixed":["1.7.1"],"affected":"1.0 - 1.6 all, 1.7.0","ecosystem":"vendor"},{"name":"FortiProxy","fixed":["7.4.12","7.6.5"],"affected":"7.0 all, 7.2 all, 7.4.0 - 7.4.11, 7.6.0 - 7.6.4","ecosystem":"vendor"},{"name":"FortiSwitchManager","fixed":["7.0.7","7.2.8"],"affected":"7.0.0 - 7.0.6, 7.2.0 - 7.2.7","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.4.10"],"affected":">= 6.4.0, < 7.4.10","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.6.5"],"affected":">= 7.6.0, < 7.6.5","ecosystem":"vendor"},{"name":"fortinet fortipam","fixed":["1.7.1"],"affected":">= 1.0.0, < 1.7.1","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.4.12"],"affected":">= 7.0.0, < 7.4.12","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":["7.6.5"],"affected":">= 7.6.0, < 7.6.5","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":["7.0.7"],"affected":">= 7.0.0, < 7.0.7","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":["7.2.8"],"affected":">= 7.2.0, < 7.2.8","ecosystem":"vendor"},{"name":"siemens ruggedcom ape1808 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortigate","fortios","fortipam","fortiproxy","fortiswitchmanager","infrastructure","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"Compare the running firmware version with the affected ranges listed in the sources (FortiOS 7.4.0-7.4.9 and 7.6.0-7.6.4; FortiProxy 7.4.0-7.4.11 and 7.6.0-7.6.4; FortiPAM 1.7.0; FortiSwitchManager 7.0.0-7.0.6 and 7.2.0-7.2.7). Review admin accounts for profiles with read-write rights.","fix":"Upgrade to FortiOS 7.4.10 or 7.6.5, FortiProxy 7.4.12 or 7.6.5, FortiPAM 1.7.1, or FortiSwitchManager 7.0.7 or 7.2.8, per Fortinet PSIRT FG-IR-26-122. Follow the CISA BOD 26-04 guidance for devices where patching is not possible.","status":"open","published_at":"2026-04-14T16:16:31+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T22:41:08+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:41:08Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to FortiOS 7.4.10 or 7.6.5, FortiProxy 7.4.12 or 7.6.5, FortiPAM 1.7.1, or FortiSwitchManager 7.0.7 or 7.2.8, per Fortinet PSIRT FG-IR-26-122. Follow the CISA BOD 26-04 guidance for devices where patching is not possible.","reach":"network","title":"FortiOS and FortiProxy: path traversal lets admins write or delete system files","impact":"high","summary":"FortiOS, FortiPAM, FortiProxy and FortiSwitchManager have a path traversal flaw in specific CLI commands. An authenticated admin with read-write permissions can write or delete arbitrary files on the device, and the flaw is exploited in the wild.","category":"infrastructure","nicknames":["PEERSTITCH"],"who_cares":["fortios","fortiproxy","fortipam","fortiswitchmanager","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker writes or deletes arbitrary files on the appliance","analyst_note":"Confirm the exact CLI commands and the detection guidance in Fortinet PSIRT FG-IR-26-122 and the Unit 42 PEERSTITCH write-up.","how_to_check":"Compare the running firmware version with the affected ranges listed in the sources (FortiOS 7.4.0-7.4.9 and 7.6.0-7.6.4; FortiProxy 7.4.0-7.4.11 and 7.6.0-7.6.4; FortiPAM 1.7.0; FortiSwitchManager 7.0.0-7.0.6 and 7.2.0-7.2.7). Review admin accounts for profiles with read-write rights.","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":3777,"output_tokens":689,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed version ranges and the vendor advisory from the Fortinet PSIRT, and check the CISA KEV entry for the exact product list.","search":"'-2025':19A,22A '-22':14A,112C '-61624':20A,23A '1.0':163C '1.1':159C '1.2':155C '1.3':151C '1.4':147C '1.5':143C '1.6':139C '1.7.0':137C '6.4':133C '7.0':129C,179C '7.0.0':187C '7.0.6':189C '7.2':125C,175C '7.2.0':183C '7.2.7':185C '7.4.0':121C,171C '7.4.11':173C '7.4.9':123C '7.6.0':117C,167C '7.6.4':119C,169C 'admin':76B,196C 'allow':191C 'ape1808':48A 'arbitrari':86B,209C 'attack':194C 'authent':75B,193C 'cli':72B,213C 'command':73B,214C 'cve':18A,21A 'cwe':13A,111C 'delet':85B,208C 'devic':90B 'directori':10A,108C 'exploit':50B,95B 'file':87B,210C 'firmware':49A 'flaw':69B,93B 'fortig':51B 'fortinet':17A,25A,32A,34A,36A,38A,40A,42A,44A,115C 'fortio':52B,60B,116C,120C,124C,128C,132C 'fortios':28A,33A,35A 'fortipam':29A,37A,53B,61B,136C,138C,142C,146C,150C,154C,158C,162C 'fortiproxi':54B,62B,166C,170C,174C,178C 'fortiproxy':30A,39A,41A 'fortiswitchmanag':55B,64B,182C,186C 'fortiswitchmanager':31A,43A,45A 'host':59B 'improp':2A,100C 'infrastructur':56B 'least':200C 'limit':3A,101C 'may':190C 'multiple':26A 'path':11A,67B,109C 'pathnam':6A,104C 'peerstitch':24A 'permiss':81B,204C 'products':27A 'profil':197C 'read':79B,202C 'read-writ':78B,201C 'restrict':9A,107C 'ruggedcom':47A 'self':58B 'self-host':57B 'siemens':46A 'specif':71B,212C 'travers':12A,68B,110C 'version':127C,131C,135C,141C,145C,149C,153C,157C,161C,165C,177C,181C 'via':211C 'vulner':15A,113C 'wild':98B 'write':80B,83B,203C,206C","nicknames":["PEERSTITCH"],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-14T16:16:31+00:00","kev":{"dateAdded":"2026-10-16","dueDate":"2026-10-19","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-61624","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61624","severity":null,"published_at":"2026-10-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-61624:103","url":null,"severity":null,"published_at":"2026-10-23T21:33:58+00:00","modified_at":"2026-10-23T21:33:58+00:00","first_seen_at":"2026-10-23T21:33:58+00:00","fetched_at":"2026-10-23T21:33:58+00:00","note":"Read Fortinet PSIRT FG-IR-26-122 (published 2026-04-14, Medium CVSS 6.0, known exploited) for versions; Unit 42 reports exploitation as a zero-day by CL-STA-0954/UNC5820 to deploy PEERSTITCH after a FortiManager compromise. No public PoC found. Severity kept at high because of KEV listing and exploitation."},{"source":"nvd","external_id":"CVE-2025-61624","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61624","severity":null,"published_at":"2026-04-14T16:16:31+00:00","modified_at":"2026-10-17T04:16:43+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1094,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-122","title":"Fortinet PSIRT FG-IR-26-122 (CVE-2025-61624)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1094,"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-122","title":"Fortinet PSIRT FG-IR-26-122 (CVE-2025-61624)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1095,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61624","title":"NVD CVE-2025-61624","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1106,"url":"https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/","title":"Unit 42: PEERSTITCH, a stealthy FortiGate implant","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1107,"url":"https://thehackernews.com/2026/10/attackers-exploit-fortios-flaw-to.html","title":"The Hacker News: PEERSTITCH deployed via FortiOS flaw","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1108,"url":"https://x.com/zoomeyebot/status/2113325851958038955","title":null,"kind":"post","source":"analyst","text":"PEERSTITCH Implant Deployed Through FortiOS Auto-Script Flaw (CVE-2025-61624). ZoomEye dork app=\"Fortinet FortiGate\": 39k instances identified globally.","published_at":"2026-10-22T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}