Skip to content
CVE PROGRAM SOURCE RECORD9.0 Critical

CVE-2025-22252

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and v

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiProxy

Default version status: unaffected

  • 7.6.0 to ≤ 7.6.1affected

Fortinet FortiSwitchManager

Default version status: unaffected

  • 7.2.5affected

Fortinet FortiOS

Default version status: unaffected

  • 7.6.0affected
  • 7.4.4 to ≤ 7.4.6affected

References