This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 13 vulnerabilities in various products

Fortinet fixes 13 vulnerabilities in various products. The most serious vulnerabilities are listed below. Products and their fixed versions: FortiADC - 7.6.2, 7.4.8, 7.2.11, 7.1.5 [1] FortiOS - 7.6.2, 7.4.8 [2][4][5][7][11][12][13] FortiProxy - 7.6.2, 7.4.8, 7.2.10, 7.0.17 [2][5][12] FortiWeb - 7.6.2, 7.4.8 [2] FortiPAM - 1.4.2, 1.3.1, 1.2.1, 1.1.3, 1.0.4 [3]; FortiSRA - 1.4.2 [3] FortiClientEMS - 7.4.3, 7.2.7 [6][8] FortiClientWindows - 7.4.1, 7.2.7 [9] FortiPortal - 7.4.1, 7.2.6, 7.0.9 [10]

FortiADC - OS command injection (CVE-2025-31104)
CVSS 7.2 (High)

An authenticated remote attacker can execute commands in the operating system of the affected device by sending specially crafted HTTP requests [1].

The vulnerability is present in product:

  • FortiADC; >=6.1, <6.3; >=7.0, <7.1.4; >=7.2, <7.2.7; >=7.4, <7.4.6; >=7.6, <7.6.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C

More information:

  • CVE-2025-31104 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 6. 2025.

FortiOS, FortiProxy, FortiWeb - privilege escalation (CVE-2025-22254)
CVSS 6.6 (Medium)

An authenticated remote attacker with read-only admin privileges can escalate their privileges to super-admin by sending specially crafted requests to the Node.js websocket [2].

The vulnerability is present in products:

  • FortiOS; >=6.4, <6.4.16; >=7.0, <7.0.17; >=7.2, <7.2.11; >=7.4, <7.4.7; >=7.6, <7.6.2;
  • FortiProxy; >=7.4, <7.4.7; >=7.6, <7.6.2;
  • FortiWeb; >=7.4, <7.4.7; >=7.6, <7.6.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

FortiPAM, FortiSRA - unauthorized access (CVE-2025-22256)
CVSS 6.3 (Medium)

An authenticated remote attacker can gain unauthorized access to certain resources by sending specially crafted requests [3].

The vulnerability is present in products:

  • FortiPAM; >=1.0, <1.0.4; >=1.1, <1.1.3; >=1.2, <1.2.1; >=1.3, <1.3.1; >=1.4, <1.4.1;
  • FortiSRA; >=1.4, <1.4.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

FortiClientEMS - unauthorized access (CVE-2024-32119)
CVSS 4.8 (Medium)

An unauthenticated remote attacker can impersonate the victim by sending specially crafted TCP requests and thereby make unauthorized use of certain operations, such as uploading and tagging data. To exploit the vulnerability, the attacker must know the victim's FCTUID and VDOM [6].

The vulnerability is present in product:

  • FortiClientEMS; >=7.2, <7.2.5; >=7.4, <7.4.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

FortiClientWindows - VPN redirections (CVE-2024-54019)
CVSS 4.8 (Medium)

An unauthenticated remote attacker can, under certain circumstances, redirect VPN connections [9].

The vulnerability is present in product:

  • FortiClientWindows; >=7.2, <7.2.7; >=7.4, <7.4.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:W/RC:C

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

FortiPortal - information disclosure (CVE-2024-45329)
CVSS 4.3 (Medium)

An authenticated remote attacker can view device information by sending modified API requests [10].

The vulnerability is present in product:

  • FortiPortal;  >=7.4, <7.4.1; >=7.2, <7.2.6; >=7.0, <7.0.9;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 10. 6. 2025.

By CESNET, z.s.p.o. Martin Krajči on 12. 6. 2025.

CESNET, z.s.p.o. Logo