CVE-2025-24472
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-03-18. Federal due date: 2025-04-08.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fortinet | Fortiproxy | from 7.0.0 before 7.0.20 from 7.2.0 before 7.2.13 |
| Fortinet | Fortios | from 7.0.0 before 7.0.17 |