Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2025-24472

🗓️ 11 Feb 2025 16:50:42Reported by fortinetType 
cve
 cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 419 Views

Authentication Bypass vulnerability in FortiOS and FortiProxy allows remote super-admin access.

Related
Detection
Affected
Refs
Social
ReporterTitlePublishedViews
Family
attackerkb
ATTACKERKB		CVE-2025-24472
11 Feb 202517:15
–attackerkb
githubexploit
GithubExploit		Exploit for Authentication Bypass Using an Alternate Path or Channel in Fortinet Fortiproxy
23 Jul 202603:45
–githubexploit
bdu_fstec
BDU FSTEC		The vulnerability of the WebSocket module in Node.js operating systems on FortiOS and proxy servers, which allows attackers to elevate privileges to the “super-admin” level.
12 Feb 202500:00
–bdu_fstec
circl
Circl		CVE-2025-24472
11 Feb 202517:17
–circl
cisa_kev
CISA KEV Catalog		Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
18 Mar 202500:00
–cisa_kev
cisa
CISA		 CISA Adds Two Known Exploited Vulnerabilities to Catalog
18 Mar 202512:00
–cisa
cnnvd
CNNVD		Fortinet FortiOS 访问控制错误漏洞
11 Feb 202500:00
–cnnvd
cvelist
Cvelist		CVE-2025-24472
11 Feb 202516:50
–cvelist
euvd
EUVD		EUVD-2025-3725
3 Oct 202520:07
–euvd
nessus
Tenable Nessus		Fortinet Fortigate Authentication bypass in Node.js websocket module and CSF requests (FG-IR-24-535)
14 Jan 202500:00
–nessus
Rows per page
NVD
Vulners
Node
OR
fortinetfortiproxyRange7.0.0–7.0.20
fortinetfortiproxyRange7.2.0–7.2.13
fortinetfortiosRange7.0.0–7.0.17
[
  {
    "vendor": "Fortinet",
    "product": "FortiOS",
    "cpes": [
      "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.16",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Fortinet",
    "product": "FortiProxy",
    "cpes": [
      "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "versions": [
      {
        "versionType": "semver",
        "version": "7.2.0",
        "lessThanOrEqual": "7.2.12",
        "status": "affected"
      },
      {
        "versionType": "semver",
        "version": "7.0.0",
        "lessThanOrEqual": "7.0.19",
        "status": "affected"
      }
    ]
  }
]

Score-Imaginary

GunraRansomwareTargetsGlobalCriticalInfrastructure

falconupkid

GunraRansomware:MultithreadedChaCha20EncryptionExplained

WebLinkr

Fortinet'sFortiBleedCVEandthegrowinglegacyofVPNs-PersonalSASE-The#1CorporateVPNAlternative(CVE-2024-55591)

Dark-Marc

CISAFlagsNewVulnerabilities:ImmediateActionRequired

MauriceTorres

🚨PatchTuesdayAlert:March2025

deadlockfinger

New ransomware alert The 'Mora_001' group is using Fortinet auth bypass flaws (CVE-2024-55591 & CVE-2025-24472) to deploy the 'SuperBlack' ransomware, tying back to LockBit operations. Update your Fortinet devices ASAP to stay safe #Ransomware #CyberSecurity

TweetThreatNews

A new zero-day vulnerability (CVE-2025-24472) in FortiOS/FortiProxy allows attackers to gain super-admin privileges remotely. Affects versions 7.0.0 to 7.0.16. High severity (CVSS 8.1). #Fortinet #InfoSec #USA link: https://t.co/xWTJ2jMSUF

rst_cloud

#threatreport #LowCompleteness Flash Notice: CVE-2025-24472 Actively Exploited - Patch and Manage | 03-03-2025 Source: https://t.co/wBSd26dLs7 Key details below ↓ Victims: Fortinet CVEs: CVE-2024-55591 \[[Vulners](https://t.co/oy3q2NTvpy)] - CVSS V3.1: *9.8*, - Vulners: Exploitation: True Soft: - fortinet fortiproxy (<7.0.20, <7.2.13) - fortinet fortios (<7.0.17) CVE-2025-24472 \[[Vulners](https://t.co/sMlyEoXz35)] - CVSS V3.1: *8.1*, - Vulners: Exploitation: Unknown LLM extracted TTPs:` T1190 IOCs: - IP: 6 - File: 1 #threatreport: CVE-2025-24472 is a critical authentication bypass vulnerability identified in Fortinet's FortiOS and FortiProxy. This vulnerability allows remote attackers to escalate their privileges to super-admin status by sending specifically crafted Cooperative Security Fabric (CSF) proxy requests. The flaw has been confirmed as actively exploited, with Arctic Wolf observing at least one significant campaign leveraging this vulnerability. It is noteworthy that systems updated to address CVE-2024-55591 are also safeguarded against CVE-2025-24472. However, currently, there are no reports indicating active exploitation of this vulnerability in the wild. In terms of mitigation against ransomware and malware attacks, the text discusses the role of Security Information and Event Management (SIEM) systems. Such systems enhance an organization's ability to detect potential threats early, thus reducing the impact of successful attacks. A specific mention is made regarding Avertium’s approach to utilizing SIEM for detecting ransomware infections before they activate. The SIEM system offers a comprehensive view of the IT environment, enabling security teams to identify and analyze unusual behaviors effectively. Further, Avertium proposes a Cybersecurity Strategy service that includes various strategic security assessments to evaluate and strengthen security posture, threat mapping to identify potential attack scenarios using cyber threat intelligence, and the development of a Cyber Maturity Roadmap. The roadmap aims to create a systematic approach for enhancing cybersecurity resilience, covering policy development, virtual CISO support, training, tabletop exercises, and continuity planning. Overall, these strategies are designed to align security initiatives with business objectives, prioritizing both security effectiveness and cost efficiency.

BleepinComputer

Fortinet has informed us that the new CVE-2025-24472 flaw added to FG-IR-24-535 today is not a zero-day and was already fixed in January. Furthermore, even though the current advisory states that the listed flaws were exploited in attacks and includes workarounds, Fortinet says that only CVE-2024-55591, and not CVE-2025-24472. It appears that this new CVE is for a different pathway to exploiting the bug that was not previously disclosed and was just now added to the Fortinet advisory about the active exploitation of CVE-2024-55591, causing the confusion. We have deleted our previous tweet, changed the title of our article, and added an update to prevent confusion. https://t.co/B2fybQETYY

transilienceai

Actively exploited CVE : CVE-2025-24472

Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
05 Aug 2026 05:16Current
9.8High risk
Vulners AI Score9.8
CVSS 3.18.1
EPSS0.06969
SSVC
CWE-288In Wild
cve-2025-24472authentication bypassfortiosfortiproxysuper-admin privilegesremote attacker.
419