{"id":"CVE-2025-24472","published":"2025-02-11T17:15:34Z","modified":"2026-08-05T05:16:43Z","title":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","vendor":"Fortinet","product":"FortiOS and FortiProxy","tier":"core","eol":null,"description":{"text":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the authentication logic of Fortinet's FortiOS and FortiProxy products, specifically within the Security Fabric's CSF proxy handling, allows authentication to be bypassed through an alternate path. The affected versions span FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12 and 7.0.0 through 7.0.19. A remote, unauthenticated attacker who knows the serial numbers of the upstream and downstream devices can send crafted CSF proxy requests to gain super-admin privileges on the downstream device, provided the Security Fabric is enabled.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:06:00Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.07235,"percentile":0.94312,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-03-18","dueDate":"2025-04-08","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-11","exploitedFirstSeen":"2025-02-11","ransomware":true,"evidence":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535","date":"2025-02-11"},{"url":"https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/","date":"2025-03-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-03-18"},{"url":"https://www.cert.at/de/warnungen/2025/3/ransomware-gruppen-nutzen-weiterhin-kritische-fortinet-schwachstellen-warnung-vor-gepatchten-aber-bereits-kompromittierten-geraten","date":"2025-03-20"},{"url":"https://www.cyfirma.com/research/tracking-ransomware-march-2025/","date":"2025-04-10"},{"url":"https://cyble.com/blog/vulnerabilities-under-attack/","date":"2025-09-23"},{"url":"https://slcyber.io/whitepapers-reports/an-escalation-in-attacks-the-ransomware-landscape-in-h1-2025/","date":"2025-09-25"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026","date":"2026-01-28"},{"url":"https://3354902.hs-sites.com/hubfs/Consulting/TTP%20Briefing/Q4%202025/Cybereason_TTP%20Briefing_%20Q42025.pdf","date":"2026-02-05"}],"evidenceTotal":23,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote unauthenticated attacker exploits Fortinet device interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"may allow a remote unauthenticated attacker with prior knowledge","start":181,"end":245}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: super-admin privileges gained, enabling account changes","mappingType":"primary_impact","evidence":[{"from":"description","quote":"to gain super-admin privileges on the downstream device","start":296,"end":351}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-3725","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-3725","exploited":true,"exploitedSince":"2025-03-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-07-23","earliestUrl":"https://github.com/razureink/cve-2025-24472-fortinet_authbypass_reproduction","repos":[{"name":"razureink/cve-2025-24472-fortinet_authbypass_reproduction","url":"https://github.com/razureink/cve-2025-24472-fortinet_authbypass_reproduction","stars":0,"created":"2026-07-23"}]},"first":{"date":"2026-07-23","source":"PoC-in-GitHub","url":"https://github.com/razureink/cve-2025-24472-fortinet_authbypass_reproduction"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1098.004"],"provenance":"ai"}],"timeline":[{"date":"2025-02-11","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24472","provenance":"source"},{"date":"2025-02-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535","provenance":"source"},{"date":"2025-03-18","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-03-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-3725","provenance":"source"},{"date":"2026-07-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/razureink/cve-2025-24472-fortinet_authbypass_reproduction","provenance":"source"}],"speed":{"daysToPublicExploit":527,"firstExploitFrom":"PoC-in-GitHub","daysToKev":35},"priority":{"score":77.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 626 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":18.86,"detail":"percentile 0.9431"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}