CVE-2025-24472

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Aug 5, 2026

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2025
Last modified
Aug 5, 2026
Added to CISA KEV
Mar 18, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-244733.7A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.CVE-2025-244742.7An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 throughCVE-2025-244776.7A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.4 through 7.2.1CVE-2025-244787.1A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicCVE-2025-244798.6A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in WindowCVE-2025-244809.3A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation aCVE-2025-244817.0An Incorrect Permission Assignment Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect permiCVE-2025-244827.0A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default permissioCVE-2025-244835.5NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially cCVE-2025-244847.8Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticCVE-2025-244857.5A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTCVE-2025-244867.8Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authentic