Eine fehlerhafte Berechtigungsverwaltung (Improper Privilege Management) [CWE-269] Schwachstelle in Fortinet FortiOS 7.6.0 bis 7.6.1, FortiOS 7.4.0 bis 7.4.6, FortiOS 7.2.0 bis 7.2.10, FortiOS 7.0.0 bis 7.0.16,

Successful exploitation of CVE-2025-22254 allows an attacker to bypass access controls and gain complete administrative control over the Fortinet device. This includes the ability to modify configurations, access sensitive data, and potentially pivot to other systems within the network. The impact is particularly severe because the attacker only requires read-only admin privileges to initiate the exploit, a permission level often granted to numerous users for monitoring purposes. This vulnerability shares similarities with privilege escalation exploits targeting web application frameworks, where insufficient access controls can be leveraged to gain elevated privileges.

Organizations heavily reliant on Fortinet FortiOS, FortiProxy, or FortiWeb appliances are at risk. Specifically, deployments utilizing read-only administrator accounts for monitoring or limited access, and those running vulnerable versions (6.4.0-7.6.1 for FortiOS, 7.4.0-7.6.1 for FortiProxy, and 7.4.0-7.6.1 for FortiWeb) are particularly vulnerable. Shared hosting environments using these appliances also face increased risk.

• fortinet: Examine FortiOS system logs for unusual websocket requests or attempts to modify system configurations by read-only administrators.

Get-WinEvent -LogName Security -FilterXPath '//Event[System[Provider[@Name='Fortinet FortiOS']]]'

• linux / server: Monitor Fortinet device logs using journalctl for suspicious activity related to the Node.js websocket module.

journalctl -u fortinet -f | grep "websocket"

• generic web: Use curl to test the websocket endpoint and observe the response for any unexpected behavior.

curl -v wss://<fortigate_ip>/node.js/websocket

1. 2025-06-10Disclosure

   disclosure

1. Reserviert2025-01-02
2. Veröffentlicht2025-06-10
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-22254 is to upgrade to a patched version of FortiOS, FortiProxy, or FortiWeb. Fortinet has released updates to address this vulnerability. If an immediate upgrade is not feasible, consider implementing stricter access controls to limit the number of users with read-only admin privileges. Review existing user permissions and remove any unnecessary access. While a WAF or proxy cannot directly prevent this privilege escalation, it can help detect and block suspicious requests associated with the exploit. Monitor Fortinet device logs for unusual activity or attempts to access privileged resources. After upgrade, confirm by verifying that the user account previously having read-only access no longer possesses super-admin privileges.