FortiOS SSL VPN
CVE-2025-25252
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects that exploitation requires prior possession of a specific SAML session record, a non-trivial prerequisite absent from the vendor-assigned AC:L rating.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.
AnalysisAI
Session replay in FortiOS SSL VPN enables former administrators, whose accounts have been revoked and sessions explicitly terminated, to reactivate those terminated VPN sessions by submitting previously captured SAML authentication records to the SSL VPN endpoint. Affected versions span FortiOS 6.4 (all versions), 7.0.0-7.0.16, 7.2.0-7.2.10, 7.4.0-7.4.6, and 7.6.0-7.6.2, covering a broad swathe of current enterprise deployments. No CISA KEV listing or public exploit code is confirmed at time of analysis, but the threat is most acute in incident-response scenarios where organizations revoke access believing the session termination is complete.
Technical ContextAI
FortiOS is Fortinet's operating system underpinning FortiGate firewall and VPN appliances; its SSL VPN component supports SAML (Security Assertion Markup Language) for federated identity and single sign-on integration. CWE-613 (Insufficient Session Expiration) describes a failure to properly invalidate server-side session state after account deletion or explicit session termination. In SAML-based flows, the service provider - FortiOS in this case - must independently verify that the originating account and associated session remain authorized; the vulnerability arises because FortiOS accepts a previously issued SAML record even after the user account has been removed and the session revoked, indicating absent or inadequate back-channel revocation validation. Affected CPE: cpe:2.3:o:fortinet:fortios across the 6.4, 7.0.x, 7.2.x, 7.4.x, and 7.6.x branches as reported by psirt@fortinet.com via FG-IR-24-487.
RemediationAI
Consult Fortinet's PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-487 for patched release versions; exact fixed version numbers are not present in the available input data and must be confirmed directly from the advisory before planning upgrades. As a compensating control pending patching, configure the upstream SAML identity provider to enforce aggressively short assertion lifetimes and ensure that user account deprovisioning in the IdP triggers immediate assertion invalidation via the IdP's revocation mechanisms - note that not all IdP implementations support synchronous back-channel revocation, which limits this control's reliability. For high-privilege accounts (administrators), consider switching SSL VPN authentication to certificate-based or hardware-token methods that do not rely on SAML assertion reuse. Additionally, audit existing SAML session logs on FortiOS for any access patterns from accounts that have been deprovisioned since the earliest affected version was deployed. Reducing SAML assertion lifetimes may degrade experience for legitimate users with long-running VPN sessions and should be communicated to end users before deployment.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today