Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-24472 8.1
Fortinet · FortiOS and FortiProxy · Added 2025-03-18 · Published 2025-02-11
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityFortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
VendorFortinet
ProductFortiOS and FortiProxy
Date added2025-03-18
Due date2025-04-08
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-288
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

NVD: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-09-05 23:43 UTC
Wall time120.0s
Searches5
Component defaultno
Sources https://fortiguard.fortinet.com/psirt/FG-IR-24-535
https://nvd.nist.gov/vuln/detail/CVE-2025-24472
https://www.bleepingcomputer.com/news/security/fortinet-discloses-second-firewall-auth-bypass-patched-in-january/
https://www.zerosday.com/post/cves/cve-2025-24472-fortios-and-fortiproxy-lab
https://github.com/exfil0/CVE-2024-55591-POC
https://docs.fortinet.com/document/fortigate/7.0.0/cli-reference/146620/config-system-csf
https://docs2.fortinet.com/document/fortigate/7.0.15/cli-reference/120351875/config-system-csf
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-015/
https://www.orangecyberdefense.com/global/blog/cert-news/new-fortinet-exploit-cve-2025-24472-disclosed
https://www.sentinelone.com/vulnerability-database/cve-2025-24472/
https://cyrisk.com/security/cve-2025-24472-authentication-bypass/
https://intruceptlabs.com/2025/02/authentication-bypass-vulnerability-in-fortios-fortiproxy/
https://www.criminalip.io/knowledge-hub/blog/25732
https://www.rescana.com/post/critical-analysis-of-cve-2025-24472-authentication-bypass-vulnerability-in-fortinet-s-fortios-and-f

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt for WebSocket upgrade requests to /ws/cli/open on FortiOS management interfaces followed by injected super_admin login context and CLI commands, correlated with jsconsole(127.0.0.1) entries in admin login logs

Research details

ComponentCSF proxy component (Communication Service Frontend proxy) of FortiOS/FortiProxy Security Fabric
PreconditionsThe primary precondition is that the target device must have the Security Fabric (CSF) feature explicitly enabled, which is not the default configuration on standard FortiGate or FortiProxy deployments. The attacker must possess prior knowledge of both the upstream device's serial number and the target downstream device's serial number. Network access to the target device's management interface (typically HTTP/HTTPS on ports 80, 443, or custom admin ports) is required for delivering crafted CSF proxy requests. The attacker crafts specially formatted CSF proxy packets that impersonate a legitimate upstream fabric device, exploiting improper validation in the downstream device's CSF proxy handler to bypass authentication and execute administrative commands with super-admin privileges. Exploitation does not require any user interaction or authentication, but the attacker must be able to reach the management interface over the network and know the serial numbers of the fabric devices involved. agent
DeliveryRemote unauthenticated attacker sends a crafted WebSocket upgrade request to the FortiOS/FortiProxy management interface endpoint /ws/cli/open with a spoofed local_access_token and injected login context containing super_admin role, bypassing authentication to gain CLI access. Alternatively, crafted CSF proxy requests with known upstream/downstream device serial numbers bypass authentication on the Security Fabric communication channel.
Public PoCyes
PoC URLs https://github.com/exfil0/CVE-2024-55591-POC Third-party repos; verify before use.
Advisoryhttps://fortiguard.fortinet.com/psirt/FG-IR-24-535
Exploit notesCVSS attack complexity: HIGH | Exploitation requires: (1) Security Fabric (CSF) enabled on the target, (2) attacker knowledge of upstream and downstream device serial numbers, (3) network access to the management interface. The PoC (exfil0/CVE-2024-55591-POC) demonstrates exploitation via crafted WebSocket upgrade to /ws/cli/open?cols=162&rows=100&local_access_token=ScaryBYte on the management port, injecting a fake login context to hijack a Telnet-like CLI session with super-admin privileges. Alternatively, crafted CSF proxy requests can bypass authentication when the device has a known serial number. Post-exploitation: arbitrary CLI commands (get system status, execute shell). IoCs: jsconsole(127.0.0.1) in login logs, arbitrary admin creation with random usernames. The WebSocket vector works on FortiOS 7.0.0-7.0.16, FortiProxy 7.0.0-7.0.19, 7.2.0-7.2.12.
SummaryFortinet FortiOS and FortiProxy | CSF proxy auth bypass (CWE-288) | Public PoC available in exfil0/CVE-2024-55591-POC repo | Security Fabric must be enabled | Vendor advisory located

Tia coverage

First reported2026-08-10

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-urges-organizations-to-patch-exposed-vpns-and-segment-netwofortibleed-attackers-locking-victims-out-of-fortinet-devicesjoint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub