CVE-2025-24472

Katalog CVE

CVSS 8.1 · High KEV · sudah dieksploitasi Dipakai ransomware EPSS 7,2%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada fortinet fortiproxy, fortinet fortios. Skor CVSS 3.1 8.1 (High) menurut fortinet.com. Masuk katalog KEV CISA pada 18 Maret 2025, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Rincian

Terbit di NVD

11 Februari 2025

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber fortinet.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel

EPSS (30 hari)

7,2% peluang dieksploitasi; lebih tinggi dari 94,2% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Masuk KEV

18 Maret 2025

Tenggat CISA

8 April 2025 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://fortiguard.fortinet.com/psirt/FG-IR-24-535 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472 pemerintah AS