CVE-2025-24472
HighPublished
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
- Published
- Feb 11, 2025
- Updated
- Aug 5, 2026
- Assigning CNA
- fortinet
- Evidence observed
- Mar 18, 2025
Primary CVSS
8.1/ 10High
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
CVE Reproduction: cve-2025-24472-fortinet_authbypass_reproduction
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.