CVE-2025-24472

This bug is like a door that should require a key (login), but in some setups a clever attacker can slip through an alternate route and end up with the highest privileges. If your Fortinet setup is exposed and configured in the vulnerable way, that could let attackers take control of the device and then block access or steal data.

This matters if you use Fortinet fortios or fortiproxy and you’re running one of the affected version ranges (FortiOS 7.0.0–7.0.16, FortiProxy 7.2.0–7.2.12, or FortiProxy 7.0.0–7.0.19). Real-world attackers have used this issue in ransomware campaigns, so it’s not just theoretical. It’s mainly a risk when the attacker can reach the relevant interfaces and the vulnerable “alternate path/channel” behavior is enabled in your environment (for example, the Security Fabric configuration described for this issue).

This is RED because the issue is confirmed in real-world ransomware activity and is listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers are actively using it to bypass authentication and obtain very high privileges, which can quickly lead to full compromise and disruption.

1. Inventory and confirm exposure

   • Identify all Fortinet devices running fortios and fortiproxy.
   • Record exact software versions.
   • Determine whether any deployments match the affected ranges: FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, and FortiProxy 7.0.0 through 7.0.19.

2. Upgrade to fixed versions (preferred remediation)

   • FortiOS: upgrade to 7.0.17 or above.
   • FortiProxy: upgrade to 7.2.13 or above, or upgrade to 7.0.20 or above.
   • Use Fortinet’s standard upgrade procedure for your model and environment, and schedule downtime if required.

3. If you cannot upgrade right away

   • Follow the vendor PSIRT mitigation steps referenced for this issue (FG-IR-24-535).
   • Follow CISA guidance from the KEV entry: apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

4. Validate after changes

   • Re-check installed versions to confirm you are no longer in the vulnerable ranges.
   • Verify the Security Fabric-related configuration (where applicable) aligns with vendor mitigation guidance for this CVE.
   • Monitor for suspicious administrative activity and any signs of unauthorized access, especially around the time of upgrade/mitigation changes.

5. CISA due date

   • KEV remediation was due by 2025-04-08. Treat this as already overdue in risk terms.

Severity is high (CVSS 8.1) with network reachability and no required user interaction. The weakness is an authentication bypass (CWE-288) that can allow an unauthenticated remote attacker, given prior knowledge of upstream and downstream device serial numbers, to obtain super-admin privileges on a downstream Fortinet device when Security Fabric is enabled, via crafted CSF proxy requests. Exploitation status: confirmed real-world exploitation per CISA KEV (added 2025-03-18), with required remediation due 2025-04-08, and noted use in ransomware campaigns; this drives the RED urgency. No public exploit code is on record, and EPSS is a prediction and is not a decision driver here due to KEV confirmation. KEV means this CVE is known to be actively exploited in the wild, prompting mandatory/priority remediation guidance.