An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-24-535 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2025, 16:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
07 Aug 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests. | |
| CWE |
19 Mar 2025, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-306 | |
| First Time |
Fortinet fortiproxy
Fortinet Fortinet fortios |
|
| CPE | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
|
| References | () https://fortiguard.fortinet.com/psirt/FG-IR-24-535 - Vendor Advisory |
11 Feb 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-11 17:15
Updated : 2025-08-08 16:06
NVD link : CVE-2025-24472
Mitre link : CVE-2025-24472
JSON object : View
Products Affected
fortinet
- fortiproxy
- fortios
CWE
No CWE.