Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-24472

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Published

2025-02-11T17:15:34.867

Last Modified

2025-08-08T16:06:31.493

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-288
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application fortinet fortiproxy < 7.0.20 Yes
Application fortinet fortiproxy < 7.2.13 Yes
Operating System fortinet fortios < 7.0.17 Yes
References