Security readout for executives and security teams
Plain-English summary
Affected FortiOS releases may accept a revoked certificate when a verified remote user connects through FortiClient using EAP. This weakens certificate revocation as an access-control safeguard and could allow access that administrators intended to terminate.
Executive priority
Schedule prompt remediation for affected appliances using this authentication path, especially those protecting sensitive networks or exposed remote access. This is not supported as an emergency exploitation event, but accepting revoked credentials undermines access termination and can produce significant integrity risk.
Technical view
CVE-2025-24471 is an improper certificate-validation flaw (CWE-295) affecting specified FortiOS 7.6 and 7.4 releases. It may let an EAP-verified remote user connect through FortiClient with a revoked certificate. CVSS 3.1 scores it 6.0, with network reachability, low complexity, low privileges, no user interaction, and high integrity impact.
Likely exposure
Exposure is most likely where affected FortiOS versions provide FortiClient remote connectivity using EAP certificate authentication. Systems not using this authentication path may have lower practical exposure. The supplied evidence identifies FortiOS 7.6.1 and below and 7.4.7 and below; confirm exact applicability with Fortinet.
Exploitation context
The supplied record does not identify this CVE as CISA KEV and provides no evidence of active, in-the-wild exploitation. Its CVSS vector contains an E:F temporal metric, but that scoring value alone does not establish observed exploitation.
Researcher notes
The record assigns CWE-295 and scores integrity impact high while confidentiality and availability impacts are none. Exploitation requires a verified remote user and the affected FortiClient/EAP connection path. The bundle does not provide fixed versions, configuration-specific workarounds, observed attack details, or evidence establishing the Siemens reference's precise product relationship.
Mitigation direction
- Inventory FortiOS versions and identify deployments using FortiClient with EAP certificate authentication.
- Consult Fortinet advisory FG-IR-24-544 for fixed releases and approved upgrade guidance.
- Upgrade affected appliances according to Fortinet guidance; fixed version numbers are not included in the supplied bundle.
- Consider limiting exposed remote EAP access until remediation is completed.
- Monitor for successful sessions associated with certificates already marked revoked.
Validation and detection
- Compare each appliance version with the affected and fixed release tables in the Fortinet advisory.
- Confirm whether FortiClient remote access uses EAP certificate authentication.
- Review authentication records for connections accepted after the presented certificate was revoked.
- After remediation, verify in an authorized test environment that revoked certificates are rejected.
- Document appliances determined unaffected, including the version and authentication-path evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-24471 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C2.83.6fortinetVulnerability scoring details
Base CVSS 3.1 score
6MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.fortinet.com/psirt/FG-IR-24-544CVE reference, fortinet
- https://cert-portal.siemens.com/productcert/html/ssa-864900.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.