CVE-2025-24472
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Description
CVE-2025-24472 is a high-severity authentication bypass vulnerability in Fortinet FortiOS and FortiProxy that allows a remote, unauthenticated attacker to gain super-admin privileges on downstream devices in a Security Fabric deployment. The vulnerability exploits an alternate path in CSF (Cooperative Security Framework) proxy requests, requiring only prior knowledge of upstream and downstream device serial numbers. With a CVSS v3.1 score of 8.1 and an EPSS score of 1.67% at the 82nd percentile, CISA has added CVE-2025-24472 to the Known Exploited Vulnerabilities catalog. Notably, this vulnerability has a known association with ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 7.0.0, < 7.0.20; >= 7.2.0, < 7.2.13 |
| fortinet | fortios | >= 7.0.0, < 7.0.17 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-535(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2025-24472 is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel), a weakness where a system that requires authentication can be bypassed through an alternate entry point that does not enforce the same authentication requirements. In FortiOS and FortiProxy, the Security Fabric communication channel used for CSF proxy requests does not properly authenticate requests when an attacker possesses the serial numbers of fabric-connected devices, allowing the attacker to bypass normal administrative authentication entirely.
Learn more: CWE-288 — Authentication Bypass Using an Alternate Path or Channel
Impact Analysis
CVE-2025-24472 has severe impact on organizations using Fortinet Security Fabric deployments. While the attack complexity is high (AC:H) due to the requirement for prior knowledge of device serial numbers, the vulnerability requires no authentication (PR:N) and no user interaction (UI:N), and is exploitable over the network (AV:N). All three CIA dimensions face maximum impact: Confidentiality (High) is compromised as super-admin access grants full visibility into firewall rules, VPN configurations, user credentials, and network traffic logs. Integrity (High) is impacted because super-admin privileges allow modification of firewall policies, creation of VPN tunnels for persistent access, and alteration of security configurations. Availability (High) is threatened as the attacker can disable security policies, disrupt network connectivity, or render the device inoperable. The confirmed ransomware association makes this vulnerability especially dangerous, as threat actors have used compromised Fortinet devices as initial access vectors to deploy ransomware across enterprise networks.
Exploit Maturity
CVE-2025-24472 has confirmed active exploitation with a known ransomware association, making it one of the most operationally dangerous vulnerabilities in the current threat landscape. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of April 8, 2025. The Fortinet PSIRT advisory FG-IR-24-535 provides the vendor disclosure. While the EPSS score of 1.67% at the 82nd percentile suggests moderate exploitation probability, the confirmed ransomware usage elevates the operational risk significantly. Fortinet edge devices are consistently among the most targeted network appliances by advanced threat actors, and authentication bypass vulnerabilities in these devices provide direct access to enterprise network infrastructure.
Remediation
-
Update FortiOS and FortiProxy immediately. Upgrade FortiOS to version 7.0.17 or later and FortiProxy to version 7.0.20 or later (for the 7.0.x branch) or 7.2.13 or later (for the 7.2.x branch). Consult the Fortinet advisory FG-IR-24-535 for detailed upgrade guidance.
-
Disable Security Fabric if it is not actively required, or restrict fabric communications to a dedicated management network segment. The vulnerability requires the Security Fabric to be enabled, so disabling it eliminates the attack surface until patches are applied.
-
Restrict management access to FortiOS and FortiProxy administrative interfaces. Implement trusted host configurations, limit management access to specific IP ranges, and disable administrative access from WAN interfaces.
-
Audit for signs of compromise by reviewing administrative access logs for unauthorized super-admin sessions, checking for newly created admin accounts, inspecting firewall policy changes, and examining VPN tunnel configurations for unauthorized entries. Given the ransomware association, also check for lateral movement indicators within the network.
-
Implement device serial number protection as a long-term measure. Treat device serial numbers as sensitive information, restrict physical and network access to devices where serial numbers could be enumerated, and monitor for reconnaissance activity targeting device identification endpoints.
Technical Details
CVE-2025-24472 is an authentication bypass vulnerability affecting FortiOS versions 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. The vulnerability exists in the Cooperative Security Framework (CSF) proxy request handling, which is part of Fortinet's Security Fabric feature. When Security Fabric is enabled, devices communicate through CSF proxy channels for centralized management and threat intelligence sharing. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that the attack requires high complexity (the attacker must know upstream and downstream device serial numbers) but requires no authentication or user interaction. By crafting CSF proxy requests that include valid device serial numbers, an unauthenticated attacker can bypass the normal authentication mechanism and gain super-admin privileges on the downstream device. This level of access provides complete control over the firewall, including the ability to modify security policies, create administrative accounts, establish VPN tunnels, and pivot into the protected network.
Frequently Asked Questions
Is CVE-2025-24472 being actively exploited?
Yes. CISA has confirmed active exploitation and has flagged a known association with ransomware campaigns. Organizations running affected FortiOS or FortiProxy versions with Security Fabric enabled should treat patching as an emergency priority.
What products are affected by CVE-2025-24472?
Fortinet FortiOS versions 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 are affected. The Security Fabric feature must be enabled for the vulnerability to be exploitable.
How do I fix CVE-2025-24472?
Upgrade FortiOS to version 7.0.17 or later and FortiProxy to version 7.0.20 or later (7.0.x branch) or 7.2.13 or later (7.2.x branch). As an interim measure, disable Security Fabric or restrict management access to trusted networks.
How severe is CVE-2025-24472?
CVE-2025-24472 is rated High with a CVSS score of 8.1 and has a confirmed ransomware association. While attack complexity is high (requiring knowledge of device serial numbers), successful exploitation grants super-admin privileges on Fortinet devices, enabling complete network compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.