Full Report
The US Cybersecurity and Infrastructure Security Agency added flaws in Fortinet and a popular GitHub Action to its Known Exploited Vulnerabilities catalog
Analysis Summary
This summary focuses exclusively on the Fortinet vulnerability (CVE-2025-24472) mentioned in the provided text.
# Vulnerability: Fortinet FortiOS/FortiProxy Authentication Bypass Used in Ransomware Attacks
## CVE Details
- CVE ID: CVE-2025-24472
- CVSS Score: 8.1 (High)
- CWE: Authentication bypass using an alternate path (Inferred from description)
## Affected Systems
- Products: FortiOS, FortiProxy
- Versions:
- FortiOS: 7.0.0 through 7.0.16
- FortiProxy: 7.0.0 through 7.0.19 AND 7.2.0 through 7.2.12
- Configurations: Not specified beyond product and version matrix.
## Vulnerability Description
This is an authentication bypass vulnerability that can be triggered via crafted CSF proxy requests. Successful exploitation allows a remote attacker to gain **super-admin privileges** on the affected device.
## Exploitation
- Status: **Exploited in the wild** (Confirmed by CISA; used in a ransomware campaign by Mora\_00, linked to LockBit).
- Complexity: Not explicitly stated, but exploitation leading to super-admin privileges suggests Moderate or High complexity depending on the specific request required.
- Attack Vector: Network (Implied by remote attacker context through proxy requests).
## Impact
- Confidentiality: High (Gaining super-admin access typically grants full access to configuration and potentially sensitive data).
- Integrity: High (Super-admin privileges allow modification of system configurations).
- Availability: High (Compromise can lead to system disruption or ransomware deployment).
## Remediation
### Patches
Users are advised to install the following resolved versions:
- FortiOS: 7.0.17, 7.2.x (implied latest safe version)
- FortiProxy: 7.0.20, 7.2.13
### Workarounds
- No specific technical workarounds were detailed in the provided text, though immediate patching is heavily implied given the active exploitation.
## Detection
- **Indicators of Compromise (IOCs):** Exploitation involves the use of CVE-2025-24472 alongside CVE-2024-55591 during the deployment of the 'SuperBlack' ransomware strain. Analyzing firewall/proxy logs for suspicious CSF proxy requests targeting authentication mechanisms may be relevant.
- **Detection Methods and Tools:** CISA has added this CVE to its Known Exploited Vulnerability (KEV) catalog, suggesting endpoint detection and response (EDR) or threat intelligence platforms should be monitored for related activity or attempts to exploit this mechanism.
## References
- Fortinet PSIRT Advisory: hxxps://fortiguard.fortinet.com/psirt/FG-IR-24-535
- Forescout analysis: hxxps://www.forescout.com/blog/new-ransomware-operator-exploits-fortinet-vulnerability-duo/
- CISA KEV Entry (Targeting CVE-2025-24472)