CVE-2025-24472
11.02.2025, 17:15
AnAuthentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests.Enginsight
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | 7.0.0 ≤ 𝑥 < 7.0.20 |
| fortinet | fortiproxy | 7.2.0 ≤ 𝑥 < 7.2.13 |
| fortinet | fortios | 7.0.0 ≤ 𝑥 < 7.0.17 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-288 - Authentication Bypass Using an Alternate Path or ChannelA product requires authentication, but the product has an alternate path or channel that does not require authentication.
- CWE-306 - Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.