CVE-2025-24472

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 7.24%
EPSS Percentile: 94.19%
CISA KEV: YES — Known Exploited Vulnerability

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: psirt@fortinet.com
Published: 12-Feb-2025 00:15
Last Modified: 05-Aug-2026 12:16
EPSS Date: 2026-10-11
CWE: CWE-288

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-03-18
Remediation Due: 2025-04-08
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472

Affected Products / Versions

fortinet / fortiproxy
Version / affected range: * · from (inclusive) 7.0.0 · before (exclusive) 7.0.20
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinet / fortiproxy
Version / affected range: * · from (inclusive) 7.2.0 · before (exclusive) 7.2.13
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
fortinet / fortios
Version / affected range: * · from (inclusive) 7.0.0 · before (exclusive) 7.0.17
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 18:21
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

warned that Gunra operators exploit FortiOS and FortiProxy issues, including CVE-2024-55591 and CVE-2025-24472, to obtain super-admin rights, bypass MFA assumptions on edge appliances, and progress into Ransomware Disclosures Fell to 862 in September as Affiliates Continued Evolving Their Tactics
CVE-2025-24472 Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited

CVE (72)

Malware (5)

Threat Actors (34)

Vendors (25)

Products (34)

Tools (23)

Industries (10)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.