← Back

CVE-2025-22258

nvd nist
Published: Oct 14, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

A heap-based buffer overflow in Fortinet FortiSRA 1.5.0, 1.4.0 through 1.4.2, FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy 7.6.0 through 7.6.1, 7.4.0 through 7.4.7, FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.2 through 7.0.16, FortiSwitchManager 7.2.1 through 7.2.5 allows attackers to escalate their privilege via specially crafted http requests.

Affected (11)

Fortinet
5 products
Fortios
Fortipam
Fortiproxy
Fortisra
Fortiswitchmanager
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 7.0.2 to 7.0.17
Fortios
From 7.2.0 to 7.2.11
Fortios
From 7.4.0 to 7.4.7
Fortios
From 7.6.0 to 7.6.3
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortipam
From 1.0.0 to 1.4.3
Fortipam
Version 1.5.0
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiproxy
From 7.4.0 to 7.4.8
Fortiproxy
From 7.6.0 to 7.6.2
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortisra
From 1.4.0 to 1.4.3
Fortisra
Version 1.5.0
Configuration E
1 vulnerable
Vulnerable SoftwareAffected Versions
Fortiswitchmanager
From 7.2.1 to 7.2.6

Related CWEs

CWE-122
Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.