An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16,

Successful exploitation of CVE-2025-22254 allows an attacker to bypass access controls and gain complete administrative control over the affected Fortinet device. This includes the ability to modify firewall policies, create new users with elevated privileges, access sensitive data, and potentially pivot to other systems within the network. The impact is particularly severe in environments where read-only administrator accounts are commonly used for monitoring or limited access purposes, as these accounts can be easily compromised to achieve full system control. The attack leverages a flaw in the Node.js websocket module, highlighting the importance of securing all components of a complex security appliance.

Organizations heavily reliant on Fortinet FortiOS, FortiProxy, or FortiWeb appliances are at risk. Specifically, deployments utilizing read-only administrator accounts for monitoring or limited access, and those running vulnerable versions (6.4.0-7.6.1 for FortiOS, 7.4.0-7.6.1 for FortiProxy, and 7.4.0-7.6.1 for FortiWeb) are particularly vulnerable. Shared hosting environments using these appliances also face increased risk.

• fortinet: Examine FortiOS system logs for unusual websocket requests or attempts to modify system configurations by read-only administrators.

Get-WinEvent -LogName Security -FilterXPath '//Event[System[Provider[@Name='Fortinet FortiOS']]]'

• linux / server: Monitor Fortinet device logs using journalctl for suspicious activity related to the Node.js websocket module.

journalctl -u fortinet -f | grep "websocket"

• generic web: Use curl to test the websocket endpoint and observe the response for any unexpected behavior.

curl -v wss://<fortigate_ip>/node.js/websocket

1. 2025-06-10Disclosure

   disclosure

1. 予約済み2025-01-02
2. 公開日2025-06-10
3. 更新日2026-02-26
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-22254 is to upgrade to a patched version of FortiOS, FortiProxy, or FortiWeb. Fortinet has released updates to address this vulnerability. If immediate patching is not possible, consider restricting access to the Node.js websocket module or implementing stricter authentication controls for read-only administrator accounts. Review existing firewall policies and user permissions to identify and remove any unnecessary privileges. Monitor system logs for suspicious activity, particularly requests originating from unusual sources or targeting the Node.js websocket module. After upgrade, confirm by verifying that the user with read-only permissions no longer has the ability to escalate privileges.