Paper/Archive/CVE-2025-22252

CVE-2025-22252

Fortinet FortiProxy — A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and…

EPSS 0.9%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 61.2.612 × 2012.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

Affected

ProductAffectedFixed inSource

FortiProxy7.6.0 – 7.6.1–CNA

FortiSwitchManager7.2.5–CNA

FortiOS7.6.0–CNA

FortiOS7.4.4 – 7.4.6–CNA

Scores by source

fortinet (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-24-472