CVE-2025-24471: Fortinet FortiOS Certificate Validation Flaw

CVE-2025-24471 Overview

CVE-2025-24471 is an Improper Certificate Validation vulnerability [CWE-295] affecting Fortinet FortiOS and FortiSASE. The flaw allows an Extensible Authentication Protocol (EAP) verified remote user to connect from FortiClient using a revoked certificate. FortiOS versions 7.6.1 and below, along with 7.4.7 and below, fail to properly enforce certificate revocation status during authentication. This weakens the trust boundary of remote access sessions and enables authenticated users to retain connectivity after their credentials should have been invalidated.

Critical Impact
An authenticated remote user with a revoked certificate can establish a FortiClient VPN session, undermining certificate revocation as a control for offboarding or credential compromise.

Affected Products

Fortinet FortiOS versions 7.6.1 and below
Fortinet FortiOS versions 7.4.7 and below
Fortinet FortiSASE (CPE reference: fortisase:25.1.39)

Discovery Timeline

2025-06-10 - CVE-2025-24471 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24471

Vulnerability Analysis

The vulnerability resides in the certificate validation logic used during EAP-based FortiClient authentication. FortiOS accepts client certificates without correctly verifying revocation status against a Certificate Revocation List (CRL) or the Online Certificate Status Protocol (OCSP). A user whose certificate was explicitly revoked by an administrator can still authenticate and receive network access. The issue is limited to integrity impact on authentication decisions; confidentiality and availability of the underlying data plane are not directly affected. Exploitation requires an attacker to possess a previously issued and now revoked certificate along with valid EAP credentials.

Root Cause

The root cause is improper certificate validation [CWE-295]. FortiOS does not consistently reject certificates that appear on a revocation list during the EAP handshake initiated by FortiClient. Revocation checking, which should be a mandatory step in Public Key Infrastructure (PKI) trust evaluation, is bypassed or incomplete in the affected code paths.

Attack Vector

An attacker who previously held a legitimate certificate, such as a terminated employee, contractor, or a user whose device was compromised and later revoked, can reuse that certificate against a vulnerable FortiOS instance. The attack requires network reachability to the FortiOS VPN endpoint and knowledge of the associated EAP credentials. No user interaction is required on the target side. Successful authentication grants the same access the certificate originally provided, effectively voiding the revocation action taken by administrators.

No public proof-of-concept or in-the-wild exploitation has been reported. Refer to the Fortinet Security Advisory FG-IR-24-544 for vendor technical details.

Detection Methods for CVE-2025-24471

Indicators of Compromise

VPN authentication events on FortiOS where the presented client certificate serial number matches an entry on the issuing Certificate Authority's CRL.
Successful FortiClient SSL-VPN or IPsec sessions from user accounts previously marked as offboarded or disabled in the identity provider.
OCSP responder logs showing revoked responses for certificate serial numbers that also appear in successful FortiOS authentication logs.

Detection Strategies

Correlate FortiOS authentication logs with CRL and OCSP responder logs to identify sessions established with revoked certificates.
Baseline expected VPN user populations and alert on authentications from identities that human resources or identity systems have flagged as terminated.
Inspect FortiClient session metadata for certificate serial numbers and cross-reference against the PKI revocation database on a scheduled interval.

Monitoring Recommendations

Forward FortiOS VPN, EAP, and administrative logs to a centralized security data lake for longitudinal analysis.
Enable OCSP stapling and CRL fetch logging on FortiOS, then monitor for validation failures or bypasses.
Alert on unusual VPN geolocation, device posture, or session duration for accounts tied to certificates issued more than a set threshold ago.

How to Mitigate CVE-2025-24471

Immediate Actions Required

Upgrade FortiOS to a fixed release as specified in Fortinet Security Advisory FG-IR-24-544.
Audit all currently active FortiClient VPN sessions and terminate any established with revoked or expired certificates.
Rotate certificates issued to high-risk populations, including recent leavers and users whose devices were previously compromised.

Patch Information

Fortinet has published fixed versions of FortiOS in advisory FG-IR-24-544. Administrators should apply the update to versions above FortiOS 7.6.1 and 7.4.7 as directed by the vendor. FortiSASE customers should confirm remediation status with Fortinet, as the service is vendor-managed. Siemens has issued a coordinated advisory for affected downstream products in Siemens Product Security Advisory SSA-864900.

Workarounds

Enforce strict OCSP checking with hard-fail behavior on FortiOS SSL-VPN and IPsec profiles, so authentication is denied when revocation status cannot be confirmed.
Shorten certificate validity periods and increase CRL publication frequency to reduce the exploitation window for revoked credentials.
Require multi-factor authentication (MFA) in addition to certificate-based EAP so a revoked certificate alone is insufficient to establish a session.

bash

# Configuration example: enforce strict revocation checking on FortiOS
config vpn certificate setting
    set strict-crl-check enable
    set strict-ocsp-check enable
    set ocsp-status enable
    set ocsp-default-server "corp-ocsp"
end