Firetruck

CVE-2025-24472

KEV · Ransomware

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

View CVE record →
Vendor / Project
Fortinet
Product
FortiOS and FortiProxy
Date added
Mar 18, 2025
Due date
Apr 8, 2025
Known ransomware use
Known
CWEs
CWE-288

Description

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes