CVE-2025-22254: Privilege Escalation in FortiOS

Successful exploitation of CVE-2025-22254 allows an attacker to bypass access controls and gain complete administrative control over the affected Fortinet device. This includes the ability to modify firewall policies, create new users with elevated privileges, access sensitive data, and potentially pivot to other systems within the network. The impact is particularly severe in environments where read-only administrator accounts are commonly used for monitoring or limited access purposes, as these accounts can be easily compromised to achieve full system control. The attack leverages a flaw in the Node.js websocket module, highlighting the importance of securing all components of a complex security appliance.

1. Reserved2025-01-02
2. Published2025-06-10
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-22254 is to upgrade to a patched version of FortiOS, FortiProxy, or FortiWeb. Fortinet has released updates to address this vulnerability. If immediate patching is not possible, consider restricting access to the Node.js websocket module or implementing stricter authentication controls for read-only administrator accounts. Review existing firewall policies and user permissions to identify and remove any unnecessary privileges. Monitor system logs for suspicious activity, particularly requests originating from unusual sources or targeting the Node.js websocket module. After upgrade, confirm by verifying that the user with read-only permissions no longer has the ability to escalate privileges.