CVE-2025-22254

Published: Jun 10, 2025Modified: Jan 14, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.

Affected (9)

Products: Fortinet: Fortios, Fortiproxy, Fortiweb

3 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	From 6.4.0 to 6.4.16
Fortinet Fortios	From 7.0.0 to 7.0.17
Fortinet Fortios	From 7.2.0 to 7.2.11
Fortinet Fortios	From 7.4.0 to 7.4.7
Fortinet Fortios	From 7.6.0 to 7.6.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiproxy	From 7.4.0 to 7.4.8
Fortinet Fortiproxy	From 7.6.0 to 7.6.2

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiweb	From 7.4.0 to 7.4.7
Fortinet Fortiweb	From 7.6.0 to 7.6.2

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-25-006

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.