FortiOS FortiProxy EUVD-2025-210466

Exploitation requires that the captive portal feature is enabled and actively in use on the targeted FortiOS or FortiProxy appliance - this is not a default configuration present in all deployments and is specifically associated with guest network or user authentication scenarios. The attacker must be capable of intercepting and modifying HTTP traffic between a victim user and the captive portal endpoint, which requires a network-adjacent MITM position (e.g., ARP poisoning, rogue AP, or physical proximity to the network segment). A legitimate user must be actively performing a captive portal authentication request during the attack window (UI:R). Exploitation is limited by: the MITM prerequisite (AC:H), the captive portal must be enabled and reachable, the victim must be interacting with the portal, and the integrity impact is constrained to header injection without direct code execution or data exfiltration.

The overall risk is low-to-moderate in most environments, consistent with the CVSS 3.1 base score of 3.1. The AC:H metric reflects the substantial prerequisite of occupying a man-in-the-middle position on the network path between the user and the Fortinet device's captive portal - a non-trivial barrier. UI:R confirms the attack is gated on a user actively authenticating through the captive portal. The scope is unchanged (S:U), and impact is integrity-only at low severity (I:L), with no confidentiality or availability impact. The E:P temporal modifier confirms proof-of-concept code exists, raising residual risk slightly above theoretical. However, no CISA KEV listing is present, and no widespread exploitation signals are evident. The practical threat is limited to adversaries already capable of network interception targeting captive portal users - a scenario more relevant to rogue hotspot or insider-threat vectors than remote internet-scale attacks. For organizations running captive portals on FortiOS or FortiProxy in public-facing or guest Wi-Fi scenarios, the real-world risk increases meaningfully due to attacker proximity being easier to achieve.

An attacker positioned on the same network segment as a captive portal user - such as on a guest Wi-Fi network via ARP spoofing - intercepts the user's HTTP authentication request to the FortiOS or FortiProxy captive portal. The attacker injects crafted CRLF sequences into the request, causing the appliance to include attacker-controlled headers in the response, potentially manipulating session cookies or cache behavior for the victim. Proof-of-concept exploit code for this technique is confirmed by the E:P temporal CVSS score.