CVE-2025-22252: Fortinet FortiProxy Auth Bypass Vulnerability

CVE-2025-22252 Overview

CVE-2025-22252 is a missing authentication for critical function vulnerability [CWE-306] affecting multiple Fortinet products. The flaw exists in FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and 7.6.0. An attacker with knowledge of an existing admin account name can bypass authentication and access the device with valid administrator privileges. The vulnerability requires no user interaction and is exploitable over the network. Fortinet published the advisory FG-IR-24-472 on May 28, 2025.

Critical Impact

Successful exploitation grants full administrative access to affected Fortinet appliances, enabling configuration tampering, traffic interception, and pivoting into protected network segments.

Affected Products

• Fortinet FortiProxy versions 7.6.0 through 7.6.1
• Fortinet FortiSwitchManager version 7.2.5
• Fortinet FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0

Discovery Timeline

• 2025-05-28 - CVE-2025-22252 published to NVD
• 2025-06-04 - Last updated in NVD database

Technical Details for CVE-2025-22252

Vulnerability Analysis

The vulnerability stems from a missing authentication check on a critical function within FortiOS, FortiProxy, and FortiSwitchManager. Affected builds fail to enforce credential validation for an administrative code path. An attacker who knows the name of an existing administrator account can present that identity and receive a valid administrative session without supplying valid credentials.

The weakness maps to [CWE-306] (Missing Authentication for Critical Function). The vulnerability is network-reachable wherever the management interface is exposed, including HTTPS administration, SSH, or API endpoints. Successful exploitation results in full compromise of confidentiality, integrity, and availability of the appliance.

Root Cause

A critical administrative function does not perform an authentication check before granting session privileges tied to the supplied admin account. The code path treats knowledge of a valid administrator username as sufficient proof of identity. This bypasses password, certificate, and multi-factor controls configured on the appliance.

Attack Vector

The attacker must reach the management interface of an affected device over the network and must know or guess a valid administrator account name. Default account names such as admin are common starting points. Once the attacker triggers the vulnerable code path, the appliance returns an authenticated administrator session. From that position, the attacker can modify firewall policies, create persistent accounts, export configuration, inspect VPN traffic, and disable logging.

No public proof-of-concept exploit code is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication. Refer to the Fortinet Security Advisory FG-IR-24-472 for vendor technical detail.

Detection Methods for CVE-2025-22252

Indicators of Compromise

• Administrator logins to FortiOS, FortiProxy, or FortiSwitchManager from unexpected source IPs, geographies, or at unusual hours.
• Creation of new administrator accounts, modification of existing admin profiles, or changes to trusted host lists without a corresponding change ticket.
• Disabled or modified logging configuration, syslog destinations, or audit settings shortly after an admin session.
• Unexpected configuration changes to firewall policies, VPN settings, or routing tables that align with reconnaissance or persistence behavior.

Detection Strategies

• Audit event log and admin log categories on affected appliances for successful admin logins that lack a corresponding authentication record or originate from unauthorized networks.
• Correlate management plane authentication events with network flow data to detect access attempts to the administrative interface from non-management subnets.
• Compare running configuration against a known-good baseline to identify unauthorized administrative modifications.

Monitoring Recommendations

• Forward FortiOS, FortiProxy, and FortiSwitchManager logs to a centralized SIEM and alert on admin authentication anomalies.
• Monitor for outbound connections from the appliance to unknown destinations, which can indicate post-compromise command and control.
• Track configuration change events and require ticket correlation for any administrative modification.

How to Mitigate CVE-2025-22252

Immediate Actions Required

• Upgrade affected appliances to fixed versions as specified in Fortinet Security Advisory FG-IR-24-472.
• Restrict management interface exposure so that administrative services are reachable only from dedicated management networks or VPN.
• Rotate all administrator credentials and review the administrator account list, removing unused or unknown accounts.
• Review configuration backups taken before and after the disclosure window for unauthorized changes.

Patch Information

Fortinet has released fixed versions for FortiOS, FortiProxy, and FortiSwitchManager. Administrators should consult Fortinet Security Advisory FG-IR-24-472 for the specific patched build numbers that correspond to each affected product line and apply the upgrade through the standard Fortinet update process.

Workarounds

• Limit administrative access using trusthost configuration entries so that admin accounts can only authenticate from approved IP ranges.
• Disable HTTP and HTTPS administrative access on internet-facing interfaces and require VPN access for management.
• Rename default administrator account names to reduce the attacker's ability to guess valid usernames required by this bypass.

# Restrict admin account to specific management network (FortiOS CLI)
config system admin
    edit "admin"
        set trusthost1 10.10.0.0 255.255.255.0
        set trusthost2 0.0.0.0 0.0.0.0
    next
end

# Disable HTTP/HTTPS admin access on WAN interface
config system interface
    edit "wan1"
        unset allowaccess
        set allowaccess ping
    next
end