CVE-2025-24472
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
Analysis
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/downstream device serial numbers to gain super-admin privileges on downstream devices.
Technical Context
The CWE-288 authentication bypass through an alternate channel exploits the trust relationship between FortiGate devices. Knowing the serial numbers (which may be exposed through SNMP, web interface, or network scanning) allows an attacker to craft requests that the downstream device trusts as coming from the upstream management device.
Affected Products
['FortiOS 7.0.0 through 7.0.16', 'FortiProxy 7.2.0 through 7.2.12', 'FortiProxy 7.0.0 through 7.0.19']
Remediation
Upgrade FortiOS/FortiProxy. Restrict SNMP access. Disable serial number display on login pages. Audit firewall configurations for unauthorized modifications.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today