CVE-2025-62631: Insufficient Session Expiration in SSLVPN
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSLVPN may allow an attacker to maintain access to network resources via an active session not terminated after a user's password change under particular conditions outside of the attacker's control
Other sources
An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62631?
CVE-2025-62631 is classified as a critical vulnerability due to its potential impact on session security.
How do I fix CVE-2025-62631?
To fix CVE-2025-62631, upgrade to FortiOS version 7.4.1 or later.
What products are affected by CVE-2025-62631?
CVE-2025-62631 affects Fortinet FortiOS versions 6.4 to 7.2 and includes 7.0 all versions.
What type of vulnerability is CVE-2025-62631?
CVE-2025-62631 is an insufficient session expiration vulnerability.
What could an attacker do by exploiting CVE-2025-62631?
An attacker could maintain unauthorized access to network resources via an active SSLVPN session.