CVE-2025-24472

HIGH8.1Published on February 11, 2025

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

CVSS score8.1 / 10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-288

Vendorsfortinet

Affected products

Vendors	Prodotto	Versioni
fortinet	fortiproxy	< 7.0.20
fortinet	fortios	< 7.0.17

Ransomware

Gunra, the Conti-Derived Ransomware Group Now Exploiting Exposed Firewalls and VPNs

CISA advisory on Gunra ransomware group exploiting exposed firewalls and VPNs. Derived from Conti, it uses double extortion and targets multiple sectors.

Aug 16, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Gunra, the Conti-Derived Ransomware Group Now Exploiting Exposed Firewalls and VPNs