An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Published: 2025-01-14
Fortinet patched a zero day authentication bypass vulnerability in FortiOS and FortiProxy that has been actively exploited in the wild as a zero-day since November 2024.
https://thehackernews.com/2025/03/vanhelsing-raas-launch-3-victims-5k.html
https://therecord.media/mora001-ransomware-gang-exploiting-vulnerability-lockbit
https://www.theregister.com/2025/03/14/ransomware_gang_lockbit_ties/
https://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/
https://www.securityweek.com/ivanti-fortinet-patch-remote-code-execution-vulnerabilities/
https://www.theregister.com/2025/01/21/fortinet_firewalls_still_vulnerable/
https://www.securityweek.com/fortinet-confirms-new-zero-day-exploitation/
Published: 2025-01-14
Updated: 2025-01-23
Known Exploited Vulnerability (KEV)
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: Critical
EPSS: 0.92998
Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.
Vulnerability of Interest