Security readout for executives and security teams
Plain-English summary
CVE-2025-24472 is an authentication bypass in Fortinet FortiOS and FortiProxy. In specific Security Fabric deployments, an unauthenticated remote attacker who already knows upstream and downstream device serial numbers could gain super-admin control of a downstream device. CISA lists it in KEV, so treat exposure as urgent.
Executive priority
Immediate action is warranted for affected Fortinet deployments. This is not merely a software defect; it can lead to complete administrative takeover of security infrastructure, and CISA KEV indicates real-world exploitation. Prioritize confirmation, patch planning, and compensating controls where patching is delayed.
Technical view
The issue is CWE-288 affecting FortiOS 7.0.0-7.0.16 and FortiProxy 7.2.0-7.2.12, 7.0.0-7.0.19. Fortinet describes crafted CSF proxy requests enabling super-admin privileges when Security Fabric is enabled. CVSS is 8.1, network exploitable, no privileges or user interaction, high impact, high attack complexity.
Likely exposure
Exposure is limited to the listed FortiOS and FortiProxy versions, especially deployments with Security Fabric enabled and upstream/downstream device relationships. Organizations using Fortinet edge or proxy infrastructure should prioritize inventory validation because successful exploitation can grant full administrative control.
Exploitation context
CISA KEV listing supports active exploitation in the wild. Public source details indicate exploitation requires prior knowledge of upstream and downstream device serial numbers, which raises complexity but does not eliminate risk for targeted attacks against Fortinet environments.
Researcher notes
Key constraints matter: Security Fabric must be enabled, and the attacker needs serial-number knowledge for upstream and downstream devices. Avoid assuming all Fortinet products are affected. Public sources provided do not include exploit mechanics, indicators, or specific fixed release numbers beyond affected ranges.
Mitigation direction
- Identify FortiOS and FortiProxy assets and versions immediately.
- Review Fortinet PSIRT FG-IR-24-535 for fixed versions and official guidance.
- Upgrade affected systems to vendor-designated unaffected or fixed releases.
- If upgrade is delayed, ask Fortinet about supported temporary risk-reduction options.
- Prioritize internet-facing or security-critical Fortinet devices first.
Validation and detection
- Compare installed versions against the affected FortiOS and FortiProxy ranges.
- Confirm whether Security Fabric is enabled on each device.
- Identify upstream and downstream Security Fabric relationships.
- Check Fortinet advisory for detection or configuration validation guidance.
- Review for unexpected super-admin accounts or configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-288: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-24472 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C2.25.9fortinetVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-24472 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-03-18T00:00:00.000Z: CVE-2025-24472 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.fortinet.com/psirt/FG-IR-24-535CVE reference, fortinet
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authentication Bypass Using an Alternate Path or Channel
Authentication Bypass Using an Alternate Path or Channel represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.