CVE-2025-22252

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-24-472	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fortinet:fortiproxy:7.6.0:::::::*
	cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:::::::*
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios:7.6.0:::::::*

History

04 Jun 2025, 14:35

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-28 08:15

Updated : 2025-06-04 14:35

NVD link : CVE-2025-22252

Mitre link : CVE-2025-22252

CVE.ORG link : CVE-2025-22252

JSON object : View

Products Affected

fortinet

fortios
fortiswitchmanager
fortiproxy

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-22252", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2025-05-28T08:15:21.070", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-472", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass."}, {"lang": "es", "value": "La falta de autenticaci\u00f3n para una funci\u00f3n cr\u00edtica en Fortinet FortiProxy versiones 7.6.0 a 7.6.1, FortiSwitchManager versi\u00f3n 7.2.5 y FortiOS versiones 7.4.4 a 7.4.6 y versi\u00f3n 7.6.0 puede permitir que un atacante con conocimiento de una cuenta de administrador existente acceda al dispositivo como un administrador v\u00e1lido a trav\u00e9s de una omisi\u00f3n de autenticaci\u00f3n."}], "lastModified": "2025-06-04T14:35:38.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1A9E35E-AA55-44C4-BAAC-2E44E6DCE2EF"}, {"criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E5AF7C2-3954-4931-8929-7D1A3A9B4FAA"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E4A264B-EFE6-466C-8E86-3DA465C4751C", "versionEndExcluding": "7.4.7", "versionStartIncluding": "7.4.4"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44CE8EE3-D64A-49C8-87D7-C18B302F864A"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}