CVE-2025-25248: Fortinet FortiOS DOS Vulnerability

CVE-2025-25248 Overview

CVE-2025-25248 is an integer overflow vulnerability [CWE-190] affecting Fortinet FortiOS, FortiProxy, and FortiPAM. The flaw resides in the SSL-VPN Remote Desktop Protocol (RDP) and Virtual Network Computing (VNC) bookmark handling. An authenticated attacker can send crafted requests to disrupt SSL-VPN availability on the affected device. Exploitation requires valid authentication but no user interaction, and the vulnerability is reachable over the network.

Critical Impact
Authenticated attackers can trigger a denial-of-service condition against the SSL-VPN service, cutting off remote access for legitimate users of FortiOS, FortiProxy, and FortiPAM appliances.

Affected Products

FortiOS versions 6.4 (all), 7.2 (all), 7.2.10 and below, 7.4.7 and below, and 7.6.2 and below
FortiProxy versions 2.0 (all), 7.0 (all), 7.2 (all), 7.4.3 and below, and 7.6.2 and below
FortiPAM versions 1.0 (all), 1.1 (all), 1.2 (all), 1.3 (all), 1.4.2 and below, and 1.5.0

Discovery Timeline

2025-08-12 - CVE-2025-25248 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-25248

Vulnerability Analysis

The vulnerability is an integer overflow or wraparound condition in the SSL-VPN bookmark subsystem of FortiOS, FortiProxy, and FortiPAM. Specifically, the RDP and VNC bookmark handlers fail to validate size-related integer values used when processing bookmark requests. An authenticated user with SSL-VPN access can submit crafted RDP or VNC bookmark data that causes an arithmetic wraparound during processing.

The resulting condition disrupts the availability of the SSL-VPN service. Confidentiality and integrity are not affected, but the SSL-VPN daemon becomes unavailable to legitimate users. The attack is executed remotely against the SSL-VPN interface once the attacker has authenticated.

Root Cause

The root cause is unsafe arithmetic in the code paths that handle SSL-VPN RDP and VNC bookmarks. Untrusted numeric input is used in size or length calculations without adequate bounds checking. When these values exceed the representable range of the underlying integer type, they wrap around, producing incorrect memory or buffer parameters that trigger the availability failure.

Attack Vector

Exploitation requires a valid SSL-VPN account on the target Fortinet device. The attacker authenticates to the SSL-VPN portal and submits crafted requests to the RDP or VNC bookmark functionality. The crafted values drive the integer overflow, causing the SSL-VPN service to fail. Since only low privileges are required, any compromised or rogue user account can trigger the condition.

No public proof-of-concept exploit is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. See the Fortinet Security Advisory FG-IR-24-364 for vendor-specific technical detail.

Detection Methods for CVE-2025-25248

Indicators of Compromise

Unexpected SSL-VPN service crashes, restarts, or availability drops on FortiOS, FortiProxy, or FortiPAM devices
Repeated malformed RDP or VNC bookmark requests originating from a single authenticated SSL-VPN user
Bursts of failed SSL-VPN sessions correlated with bookmark-related administrative API calls

Detection Strategies

Baseline normal SSL-VPN bookmark activity per user and alert on anomalous volume or malformed payloads targeting RDP or VNC bookmark endpoints
Correlate SSL-VPN daemon restart events with the authenticated user session that immediately preceded the failure
Review authentication logs for accounts making unusual bookmark modification requests, particularly from unexpected source IPs or geographies

Monitoring Recommendations

Forward FortiOS, FortiProxy, and FortiPAM logs to a centralized logging platform for retention and correlation
Monitor SSL-VPN service health metrics and alert on availability degradation
Track configuration changes to SSL-VPN bookmarks and flag rapid or repetitive modifications by a single account

How to Mitigate CVE-2025-25248

Immediate Actions Required

Upgrade affected devices to fixed versions as specified in the Fortinet Security Advisory FG-IR-24-364
Audit SSL-VPN user accounts and remove or disable accounts that are inactive, shared, or no longer required
Enforce multi-factor authentication (MFA) on all SSL-VPN accounts to reduce the risk of credential misuse

Patch Information

Fortinet has published fixed releases for FortiOS, FortiProxy, and FortiPAM. Administrators should consult the Fortinet Security Advisory FG-IR-24-364 for the exact fixed version corresponding to each affected branch. Siemens has also published a related advisory in SSA-864900 for downstream affected products.

Workarounds

Disable RDP and VNC bookmark functionality within the SSL-VPN portal until patches can be applied
Restrict SSL-VPN portal access to trusted source networks using firewall policies or geo-based access controls
Limit which user groups are permitted to create or modify SSL-VPN bookmarks to reduce the attack surface

bash

# Example: disable RDP and VNC bookmarks on affected SSL-VPN portals
config vpn ssl web portal
    edit "<portal-name>"
        set bookmark-group
        # remove any RDP/VNC bookmark entries and restrict user-created bookmarks
    next
end