CVE-2025-24472

Dark-Marc

CISAFlagsNewVulnerabilities:ImmediateActionRequired

MauriceTorres

🚨PatchTuesdayAlert:March2025

deadlockfinger

New ransomware alert The 'Mora_001' group is using Fortinet auth bypass flaws (CVE-2024-55591 & CVE-2025-24472) to deploy the 'SuperBlack' ransomware, tying back to LockBit operations. Update your Fortinet devices ASAP to stay safe #Ransomware #CyberSecurity

TweetThreatNews

A new zero-day vulnerability (CVE-2025-24472) in FortiOS/FortiProxy allows attackers to gain super-admin privileges remotely. Affects versions 7.0.0 to 7.0.16. High severity (CVSS 8.1). #Fortinet #InfoSec #USA link: https://t.co/xWTJ2jMSUF

rst_cloud

#threatreport #LowCompleteness Flash Notice: CVE-2025-24472 Actively Exploited - Patch and Manage | 03-03-2025 Source: https://t.co/wBSd26dLs7 Key details below ↓ Victims: Fortinet CVEs: CVE-2024-55591 \[[Vulners](https://t.co/oy3q2NTvpy)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - fortinet fortiproxy (<7.0.20, <7.2.13) - fortinet fortios (<7.0.17) CVE-2025-24472 \[[Vulners](https://t.co/sMlyEoXz35)] - CVSS V3.1: *8.1*, - Vulners: Exploitation: Unknown LLM extracted TTPs:` T1190 IOCs: - IP: 6 - File: 1 #threatreport: CVE-2025-24472 is a critical authentication bypass vulnerability identified in Fortinet's FortiOS and FortiProxy. This vulnerability allows remote attackers to escalate their privileges to super-admin status by sending specifically crafted Cooperative Security Fabric (CSF) proxy requests. The flaw has been confirmed as actively exploited, with Arctic Wolf observing at least one significant campaign leveraging this vulnerability. It is noteworthy that systems updated to address CVE-2024-55591 are also safeguarded against CVE-2025-24472. However, currently, there are no reports indicating active exploitation of this vulnerability in the wild. In terms of mitigation against ransomware and malware attacks, the text discusses the role of Security Information and Event Management (SIEM) systems. Such systems enhance an organization's ability to detect potential threats early, thus reducing the impact of successful attacks. A specific mention is made regarding Avertium’s approach to utilizing SIEM for detecting ransomware infections before they activate. The SIEM system offers a comprehensive view of the IT environment, enabling security teams to identify and analyze unusual behaviors effectively. Further, Avertium proposes a Cybersecurity Strategy service that includes various strategic security assessments to evaluate and strengthen security posture, threat mapping to identify potential attack scenarios using cyber threat intelligence, and the development of a Cyber Maturity Roadmap. The roadmap aims to create a systematic approach for enhancing cybersecurity resilience, covering policy development, virtual CISO support, training, tabletop exercises, and continuity planning. Overall, these strategies are designed to align security initiatives with business objectives, prioritizing both security effectiveness and cost efficiency.

BleepinComputer

Fortinet has informed us that the new CVE-2025-24472 flaw added to FG-IR-24-535 today is not a zero-day and was already fixed in January. Furthermore, even though the current advisory states that the listed flaws were exploited in attacks and includes workarounds, Fortinet says that only CVE-2024-55591, and not CVE-2025-24472. It appears that this new CVE is for a different pathway to exploiting the bug that was not previously disclosed and was just now added to the Fortinet advisory about the active exploitation of CVE-2024-55591, causing the confusion. We have deleted our previous tweet, changed the title of our article, and added an update to prevent confusion. https://t.co/B2fybQETYY

transilienceai

Actively exploited CVE : CVE-2025-24472