CVE-2025-22252

Published May 28, 2025

Last updated 4 days ago

CVSS critical 9.8

FortiOS

Fortinet

FortiProxy

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-22252 is a missing authentication vulnerability found in Fortinet's FortiOS, FortiProxy, and FortiSwitchManager. It affects devices configured to use a remote TACACS+ server for authentication with ASCII authentication enabled. This vulnerability could allow an attacker with knowledge of an existing administrator account to gain unauthorized access to the device as a valid administrator by bypassing authentication. Successful exploitation of CVE-2025-22252 could grant attackers unauthorized control over network infrastructure. This could lead to a compromise of system confidentiality through data exposure, integrity via configuration tampering, and availability by disrupting critical services. The vulnerability is limited to configurations using TACACS+ with ASCII authentication; PAP, MSCHAP, and CHAP configurations are not impacted.

Description: A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.
Source: psirt@fortinet.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@fortinet.com: CWE-306

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C1A9E35E-AA55-44C4-BAAC-2E44E6DCE2EF"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:7.2.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8E5AF7C2-3954-4931-8929-7D1A3A9B4FAA"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E4A264B-EFE6-466C-8E86-3DA465C4751C",
            "versionEndExcluding": "7.4.7",
            "versionStartIncluding": "7.4.4"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "44CE8EE3-D64A-49C8-87D7-C18B302F864A"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.