Authentication Bypass in Fortinet FortiOS/FortiProxy (CVE‑2025‑24472) Grants Remote Super‑Admin Access
What It Is – Fortinet disclosed an authentication‑bypass flaw (CVE‑2025‑24472) in FortiOS and FortiProxy. A crafted CSF proxy request can bypass normal login checks and give the attacker full super‑admin privileges.
Exploitability – The vulnerability is remotely exploitable without authentication; proof‑of‑concept code is publicly available. CVSS v3.1 rates it at 9.8 (Critical).
Affected Products – Fortinet FortiOS (all supported versions) and FortiProxy appliances/virtual instances.
Why It Matters for Trust & Control Assurance
- Access‑Control Assurance – The flaw demonstrates a breakdown in privileged‑access enforcement, a core control objective across all major frameworks (e.g., NIST CSF 2.0 “Protect – Access Control”).
- Continuous Monitoring Gap – Without real‑time detection of anomalous privileged activity, organizations cannot produce defensible audit evidence that super‑admin accounts are protected.
- Supply‑Chain Trust – Many enterprises rely on Fortinet devices as a security‑perimeter component; a breach here erodes the trust signal that the underlying control environment is sound.
Recommended Actions
- Apply Fortinet’s Patch Immediately – Verify that the latest FortiOS/FortiProxy firmware (version X.Y.Z or later) is deployed.
- Enforce Multi‑Factor Authentication for All Admin Access – Add MFA to the web‑UI and CLI admin logins.
- Enable and Review Privileged‑Account Logging – Ensure detailed session logging is on and forward logs to a SIEM for continuous monitoring.
- Conduct a Post‑Patch Privilege Review – Audit existing super‑admin accounts, remove unused credentials, and validate that least‑privilege principles are enforced.
Source: CISA KEV – CVE‑2025‑24472