CVE-2025-24472: Authentication bypass in Node.js websocket module and CSF requests
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
Other sources
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module or via crafted CSF proxy requests. Please note that reports show this is being exploited in the wild.
— FortiGuard
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiOSto a version that resolves this vulnerability.Fixed in 7.0.17 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.0.20 - Upgrade
Upgrade
FortiProxyto a version that resolves this vulnerability.Fixed in 7.2.13
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-24472?
CVE-2025-24472 is considered a critical vulnerability as it allows remote attackers to gain super-admin privileges.
How do I fix CVE-2025-24472?
To fix CVE-2025-24472, upgrade FortiOS to version 7.0.17 or later and FortiProxy to version 7.2.13 or later.
What versions are affected by CVE-2025-24472?
CVE-2025-24472 affects FortiOS versions 7.0.0 through 7.0.16 and 7.0.0 through 7.0.19, as well as FortiProxy versions 7.2.0 through 7.2.12.
Who is vulnerable to CVE-2025-24472?
Any organization using the affected versions of FortiOS or FortiProxy is vulnerable to CVE-2025-24472.
What type of attack does CVE-2025-24472 enable?
CVE-2025-24472 enables an authentication bypass attack through crafted CSF proxy requests.