CVE-2025-22252

CWE-306 — Missing Authentication4 documents4 sources
Severity
7.2HIGH
EPSS
0.2%
top 52.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Fortinet FortiosFortinet FortiproxyFortinet Fortiswitchmanager
Timeline
PublishedMay 28

Description

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶NVDfortinet/fortios7.4.4 — 7.4.7+1
▶CVEListV5fortinet/fortios7.4.4 — 7.4.6+1
▶CVEListV5fortinet/fortiproxy7.6.0 — 7.6.1

🔴Vulnerability Details

2
CVEList
CVE-2025-22252: A missing authentication for critical function in Fortinet FortiProxy versions 7↗2025-05-28
▶
GHSA
GHSA-2w29-fw64-5ggm: A missing authentication for critical function in Fortinet FortiProxy versions 7↗2025-05-28
▶

📋Vendor Advisories

1
Fortinet
TACACS+ authentication bypass↗2025-05-28
▶
CVE-2025-22252 (HIGH CVSS 7.2) | A missing authentication for critic | cvebase.io