FortiProxy CVE-2025-25255

Exploitation requires that the target be running an affected build (FortiOS 7.6.0-7.6.3, or FortiProxy 7.6.0-7.6.3, 7.4.0-7.4.11, all 7.2, 7.0.1-7.0.22) with the domain-fronting protection feature in use - if that feature is not relied upon for egress/policy enforcement, the bypass has no security consequence. The attacker must be able to send HTTP requests through the proxy and craft them to mismatch the fronting host from the real destination. Limiting factors: impact is confined to defeating one security-control feature (I:L only, no C or A impact), and the CVSS PR:L suggests some privilege is needed, though the description characterizes the actor as an unauthenticated proxy user - this ambiguity caps confidence on whether truly anonymous traffic suffices.

This is a genuinely low-priority issue by multiple independent signals, not a high-CVSS item masquerading as low risk. The vendor (Fortinet PSIRT) CVSS 3.1 base score is only 4.3 (Medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but requiring some privilege (PR:L) and yielding only limited integrity impact (I:L) with no confidentiality or availability impact. EPSS reinforces this: 0.43% exploitation probability at the 36th percentile, i.e. below-median likelihood of exploitation activity. There is no CISA KEV listing and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' CONFLICT TO VERIFY: the description states an 'unauthenticated proxy user' can trigger the bypass, yet the CVSS vector encodes PR:L (requiring low-level privileges) - these disagree on whether authentication is needed; the 'proxy user' is likely an unauthenticated client traversing the proxy rather than an authenticated FortiOS user, so PR:L may overstate the barrier. The real-world impact is also narrow: the flaw only defeats the domain-fronting protection feature (a policy/egress-control bypass), not direct code execution or data disclosure, so risk is meaningful mainly to organizations that specifically rely on FortiProxy/FortiOS domain-fronting enforcement for egress control. Overall: monitor and patch in routine cycles rather than treat as an emergency.

An actor positioned to send traffic through an affected FortiProxy/FortiOS proxy crafts HTTP requests whose outer (fronting) host differs from the true destination, slipping past the domain-fronting protection intended to block such evasion. This lets malware or an insider reach a disallowed destination (e.g. a C2 or data-exfiltration endpoint) that policy should have blocked. No public exploit code or active exploitation has been identified; given AV:N/AC:L, the crafting of the request itself is technically straightforward.