CVE-2025-24471

CWE-295 — Improper Certificate Validation4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 70.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Fortinet FortiosFortinet Fortisase
Timeline
PublishedJun 10

Description

An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDfortinet/fortios7.4.0 — 7.4.8+1
▶CVEListV5fortinet/fortios7.6.0 — 7.6.1+1
▶NVDfortinet/fortisase25.1.39

🔴Vulnerability Details

2
CVEList
CVE-2025-24471: An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7↗2025-06-10
▶
GHSA
GHSA-47gg-69h8-fx9p: An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7↗2025-06-10
▶

📋Vendor Advisories

1
Fortinet
eap-cert-auth bypass via revoked certificate↗2025-06-10
▶
CVE-2025-24471 (MEDIUM CVSS 6.5) | An Improper Certificate Validation | cvebase.io