CVE-2025-47890: Fortinet FortiOS Open Redirect Vulnerability

CVE-2025-47890 Overview

CVE-2025-47890 is an open redirect vulnerability [CWE-601] affecting multiple Fortinet products, including FortiOS, FortiProxy, and FortiSASE. The flaw allows an unauthenticated attacker to redirect users to arbitrary external sites through crafted HTTP requests. Exploitation requires user interaction, typically by tricking a victim into clicking a specially crafted link. Successful abuse enables phishing campaigns and credential harvesting by leveraging the trust users place in Fortinet-hosted domains.

Critical Impact
Unauthenticated attackers can redirect victims from a trusted Fortinet URL to attacker-controlled sites, enabling phishing and credential theft against administrators and end users.

Affected Products

Fortinet FortiOS 6.4 (all versions), 7.0 (all versions), 7.2 (all versions), 7.4.0 through 7.4.8, 7.6.0 through 7.6.3
Fortinet FortiProxy 7.0, 7.2, 7.4 (all versions), and 7.6.0 through 7.6.3
Fortinet FortiSASE 25.2.a

Discovery Timeline

2025-10-14 - CVE-2025-47890 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2025-47890

Vulnerability Analysis

The vulnerability is classified as URL Redirection to Untrusted Site [CWE-601], commonly known as an open redirect. Affected Fortinet products fail to properly validate destination URLs supplied in HTTP request parameters. An attacker constructs a URL pointing to a legitimate Fortinet appliance hostname that embeds an external destination. When a user visits the crafted link, the appliance issues an HTTP redirect to the attacker-controlled site without warning.

The attack requires no authentication but does require user interaction. The scope is changed because the redirect crosses trust boundaries: the target host is a trusted Fortinet management or portal interface, while the destination is arbitrary. This makes the flaw useful for phishing campaigns that impersonate Fortinet login pages or serve malicious payloads.

Root Cause

The root cause is insufficient validation of redirect target parameters within HTTP handlers exposed by FortiOS, FortiProxy, and FortiSASE web interfaces. The affected endpoints accept a user-supplied URL and use it as the target of an HTTP Location header without enforcing an allowlist of trusted hosts or ensuring the destination is relative to the appliance.

Attack Vector

The attack vector is network-based. An attacker crafts a URL that references a vulnerable Fortinet appliance and embeds a redirect parameter pointing to an untrusted domain. The attacker distributes the link through email, chat, or malicious advertising. When the victim clicks the link, their browser is transparently redirected from the legitimate Fortinet host to the attacker's site. The attacker-controlled destination typically mimics a Fortinet login screen to harvest credentials or delivers malware.

The vulnerability mechanism is documented in the Fortinet PSIRT Advisory FG-IR-24-542. No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2025-47890

Indicators of Compromise

HTTP requests to Fortinet management interfaces containing redirect parameters with external URLs in query strings
Web server logs showing HTTP 301 or 302 responses from FortiOS, FortiProxy, or FortiSASE endpoints with Location headers pointing to non-Fortinet domains
Phishing emails containing links to legitimate Fortinet appliance hostnames followed by suspicious query parameters

Detection Strategies

Inspect proxy and firewall logs for outbound HTTP redirects originating from Fortinet appliance IP addresses to unfamiliar external domains
Correlate user click activity in email security gateways with URLs targeting Fortinet appliance hostnames that include redirect query parameters
Deploy signatures on network detection tools to flag HTTP responses from FortiOS, FortiProxy, or FortiSASE containing Location headers with unexpected external domains

Monitoring Recommendations

Enable verbose HTTP request logging on FortiOS and FortiProxy management interfaces to capture full request URIs and referrers
Alert on user reports of unexpected login prompts appearing after clicking Fortinet-related links
Continuously monitor for phishing kits impersonating Fortinet login pages via threat intelligence feeds

How to Mitigate CVE-2025-47890

Immediate Actions Required

Upgrade FortiOS to a fixed version above 7.6.3 or 7.4.8 as directed by the Fortinet PSIRT advisory
Upgrade FortiProxy to a fixed version above 7.6.3, and migrate FortiSASE deployments off version 25.2.a
Restrict management interface exposure to trusted networks and enforce strict access controls
Educate administrators and end users about the phishing risk associated with unverified links to appliance hostnames

Patch Information

Fortinet has published remediation guidance in the Fortinet PSIRT Advisory FG-IR-24-542. Siemens has also released related guidance in the Siemens Security Advisory SSA-864900 for affected downstream deployments. Apply the vendor-recommended upgrade paths for each affected product family.

Workarounds

Limit access to Fortinet appliance management and portal interfaces from the public internet using network-level ACLs
Deploy a web application firewall in front of exposed Fortinet portals to filter requests containing external URLs in redirect parameters
Configure email security gateways to inspect and rewrite links pointing to Fortinet appliance hostnames that carry suspicious query parameters

bash

# Example FortiOS CLI: restrict administrative access to trusted management hosts
config system interface
  edit "port1"
    set allowaccess ping https ssh
    set trust-ip-1 10.0.0.0 255.255.255.0
  next
end