Loading vulnerability…
CVE-2025-24472 is a high-severity authentication bypass vulnerability in FortiOS and FortiProxy. It affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. The flaw is classified as CWE-288 and stems from insufficient implementation of authentication mechanisms in handling CSF proxy requests within Security Fabric functionality. A remote unauthenticated attacker who knows the serial numbers of the upstream and downstream devices can send crafted CSF proxy requests to a downstream device and bypass normal authentication, resulting in acquisition of super-admin privileges. Public reporting also associates the issue with full device compromise and abuse in real-world intrusion chains for initial access and persistence.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept exploit for CVE-2025-24472 affecting Fortinet FortiOS and FortiProxy. It contains two files: a README describing the vulnerability, affected versions, prerequisites, and mitigation guidance; and a single executable script, exploit.py, which is the main entry point. The exploit’s purpose is to achieve unauthenticated authentication bypass against the Fortinet CSF/Security Fabric interface. It targets the hardcoded endpoint /proxy/csf/v1/authenticate over HTTPS and sends a crafted POST request with spoofed trust-related headers and JSON fields. The script sets X-Fortinet-Serial, X-Forwarded-For, and Authorization headers to the supplied serial number, uses a FortiGate-CSF user agent, and requests fabric_role=super_admin with action=register. If the target returns HTTP 200 and the response contains the string "session", the script treats the target as successfully exploited and prints the returned JSON. Operationally, the script supports two modes: direct exploitation with a known serial number via --serial, or limited enumeration mode where it cycles through a built-in list of common/default Fortinet serials often seen in lab environments. The default port is 8443, but it is configurable. TLS certificate validation is disabled, indicating the script is intended for direct interaction with appliance management interfaces regardless of certificate trust. The code is simple and functional rather than framework-based. There is no post-exploitation automation beyond obtaining and printing the session-bearing response, so the repository is best characterized as an operational PoC for gaining super-admin session access rather than a full intrusion toolkit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity authentication bypass vulnerability affecting FortiOS and FortiProxy that has been weaponized in ransomware attacks.
A vulnerability affecting FortiOS firewall devices that allows threat actors to exploit scheduled tasks on vulnerable devices.
A known vulnerability in internet-facing firewall or VPN appliances cited by CISA as an example of how Gunra ransomware affiliates obtain initial access.
A critical authentication vulnerability in Fortinet FortiOS and FortiProxy software that Gunra ransomware actors have used to gain initial access via Fortinet firewalls.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.