CVE-2025-24472
CVE-2025-24472: 2 tracked advisory records across Fortinet. CISA KEV listed; exploitation observed. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Fortinet
2 advisories- Advisory severityCritical9.6
Critical [CVE-2024-55591 +1] Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests
CVE-2025-24472Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
- Affected products in this advisory
- FortiOS
- FortiProxy
- Source-reported affected versions
- FortiOS: 7.0.0 through 7.0.16 (vendor-listed versions)
- FortiProxy: 7.0.0 through 7.2.12 (vendor-listed versions)
- Source-reported fixed versions
- FortiOS 7.0: 7.0.17
- FortiProxy 7.2: 7.2.13
- FortiProxy 7.0: 7.0.20
- Mitigation guidance
- Upgrade per the Affected/Solution table: FortiOS 7.0: 7.0.17; FortiProxy 7.2: 7.2.13; FortiProxy 7.0: 7.0.20.
- Workarounds
- Disable HTTP/HTTPS administrative interface
- Limit IP addresses that can reach the administrative interface via local-in policies:
- config firewall addressedit "my_allowed_addresses"set subnet end
- Then create an Address Group:
4 more entries in the full advisory.
- Advisory severityCritical9.6
Critical [CVE-2024-55591 +1] Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module
CVE-2024-55591Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
- Affected products in this advisory
- FortiOS
- FortiProxy
- Source-reported affected versions
- FortiOS: 7.0.0 through 7.0.16 (vendor-listed versions)
- FortiProxy: 7.0.0 through 7.2.12 (vendor-listed versions)
- Source-reported fixed versions
- FortiOS 7.0: 7.0.17
- FortiProxy 7.2: 7.2.13
- FortiProxy 7.0: 7.0.20
- Mitigation guidance
- Upgrade per the Affected/Solution table: FortiOS 7.0: 7.0.17; FortiProxy 7.2: 7.2.13; FortiProxy 7.0: 7.0.20.
- Workarounds
- Disable HTTP/HTTPS administrative interface
- Limit IP addresses that can reach the administrative interface via local-in policies:
- config firewall addressedit "my_allowed_addresses"set subnet end
- Then create an Address Group:
4 more entries in the full advisory.
Android app · Google Play
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.