平台
fortinet
修复版本
7.6.2
7.2.6
7.6.1
7.4.7
CVE-2025-22252 describes a critical authentication bypass vulnerability affecting Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and 7.6.0. This flaw allows an attacker possessing knowledge of an existing administrator account to gain unauthorized administrative access to the affected devices. The vulnerability was publicly disclosed on May 28, 2025, and a patch is available from Fortinet.
The impact of CVE-2025-22252 is severe. Successful exploitation allows an attacker to completely compromise the affected Fortinet device, effectively gaining full administrative control. This includes the ability to modify configurations, access sensitive data, install malicious software, and potentially pivot to other systems within the network. The attacker's ability to bypass authentication significantly lowers the barrier to entry, making this vulnerability a high-priority target. A compromised FortiProxy could be used to intercept and modify network traffic, leading to data breaches and further compromise. The potential for lateral movement is significant, as an attacker could leverage the compromised device to gain access to other systems on the network.
CVE-2025-22252 is currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating a higher probability of active exploitation. Public proof-of-concept (PoC) code is likely to emerge, further increasing the risk. The vulnerability's ease of exploitation, coupled with the critical nature of the affected devices, makes it a prime target for attackers. Refer to the Fortinet security advisory for detailed information and mitigation guidance.
Organizations heavily reliant on Fortinet FortiProxy for web filtering, VPN termination, and secure web gateways are particularly at risk. Shared hosting environments where multiple customers share the same FortiProxy instance are also vulnerable, as a compromise of one customer's account could potentially lead to broader access. Legacy deployments using older, unpatched FortiOS versions are especially susceptible.
• fortinet: Check FortiOS/FortiProxy versions.
Get-FortiProxy | Select-Object Version• fortinet: Monitor FortiProxy logs for unusual login attempts or configuration changes.
Get-FortiProxyLog -Type Authentication -StartDate (Get-Date).AddDays(-7) | Where-Object {$_.Status -ne "Success"}• fortinet: Review firewall rules for unexpected access patterns.
Get-FortiFirewallPolicy | Where-Object {$_.Action -eq "ACCEPT" -and $_.Destination -match "untrusted_network"}• generic web: Check for exposed admin interfaces via curl.
curl -I https://<fortiproxy_ip>/admindisclosure
patch
漏洞利用状态
EPSS
0.09% (25% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-22252 is to upgrade to a patched version of Fortinet FortiProxy, FortiSwitchManager, or FortiOS. Fortinet has released updates to address this vulnerability. If immediate patching is not possible due to compatibility concerns or testing requirements, consider implementing temporary workarounds such as restricting access to the FortiProxy management interface to trusted networks and enabling multi-factor authentication where possible. Monitor FortiProxy logs for suspicious activity, particularly failed login attempts or unusual configuration changes. After upgrading, confirm the fix by attempting to access the device with a known admin account and verifying that authentication is enforced as expected.
Actualice FortiProxy a una versión posterior a 7.6.1, FortiSwitchManager a una versión posterior a 7.2.5, y FortiOS a una versión posterior a 7.4.6 y 7.6.0 para corregir la vulnerabilidad de omisión de autenticación. Esto evitará que un atacante con conocimiento de una cuenta de administrador existente acceda al dispositivo como un administrador válido.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-22252 is a critical authentication bypass vulnerability in Fortinet FortiProxy, FortiSwitchManager, and FortiOS, allowing attackers with admin account knowledge to gain unauthorized access.
If you are using FortiProxy versions 7.6.0-7.6.1, FortiSwitchManager 7.2.5, or FortiOS versions 7.4.4-7.4.6 and 7.6.0, you are potentially affected by this vulnerability.
Upgrade to a patched version of FortiProxy, FortiSwitchManager, or FortiOS as recommended by Fortinet. Implement temporary workarounds if patching is delayed.
CVE-2025-22252 is listed on CISA's KEV catalog, suggesting a high probability of active exploitation. Public PoCs are likely to emerge.
Refer to the official Fortinet security advisory for detailed information, mitigation guidance, and patched versions: [https://fortinet.com/security/advisory/fortinet-psirt-25-22](https://fortinet.com/security/advisory/fortinet-psirt-25-22)
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。