CVE-2025-60024: Fortinet FortiVoice Path Traversal Flaw

CVE-2025-60024 Overview

CVE-2025-60024 is a path traversal vulnerability [CWE-22] affecting Fortinet FortiVoice. The flaw allows a privileged authenticated attacker to write arbitrary files by submitting crafted HTTP or HTTPS requests. Successful exploitation can compromise confidentiality, integrity, and availability of the affected appliance.

Fortinet published the issue on December 9, 2025, in security advisory FG-IR-25-812. The vulnerability affects FortiVoice versions 7.2.0 through 7.2.2 and 7.0.0 through 7.0.7. Network-based exploitation is possible against the appliance management interface when an attacker holds valid privileged credentials.

Critical Impact
An authenticated privileged attacker can write arbitrary files to the FortiVoice file system over the network, enabling configuration tampering, persistence, or follow-on code execution.

Affected Products

Fortinet FortiVoice 7.2.0 through 7.2.2
Fortinet FortiVoice 7.0.0 through 7.0.7
Management HTTP and HTTPS interfaces on the affected versions

Discovery Timeline

2025-12-09 - CVE-2025-60024 published to NVD
2025-12-09 - Fortinet publishes security advisory FG-IR-25-812
2025-12-09 - Last updated in NVD database

Technical Details for CVE-2025-60024

Vulnerability Analysis

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. FortiVoice exposes administrative functionality over HTTP and HTTPS that accepts file path parameters. The application fails to properly normalize and validate these paths before performing write operations.

An authenticated attacker with privileged access can supply traversal sequences in path parameters. These sequences escape the intended directory and reach arbitrary locations on the underlying file system. The flaw affects confidentiality, integrity, and availability because written files can replace configuration, scripts, or web assets used by the appliance.

The issue requires authentication and privileged role assignment, which reduces opportunistic exploitation. However, compromised administrator credentials, session hijacking, or insider misuse all provide viable paths to abuse. The vulnerability is network-reachable with low attack complexity once authentication is satisfied.

Root Cause

The root cause is missing or insufficient sanitization of pathname inputs in HTTP and HTTPS request handlers. The affected endpoints do not enforce canonical path resolution against an allowlist of permitted directories. Sequences such as ../ and absolute path injections are accepted and used directly in file write operations.

Attack Vector

The attack vector is network-based and authenticated. An attacker authenticates to the FortiVoice management interface with a privileged account. The attacker then issues an HTTP or HTTPS request that includes a manipulated file path parameter. The server processes the request and writes attacker-controlled content to an arbitrary location, including locations used at boot or by administrative services.

No verified public proof-of-concept code is available at the time of publication. Refer to the Fortinet Security Advisory FG-IR-25-812 for vendor-supplied technical details.

Detection Methods for CVE-2025-60024

Indicators of Compromise

HTTP or HTTPS requests to the FortiVoice management interface containing ../, ..\, encoded variants such as %2e%2e%2f, or absolute paths in parameters
Unexpected file creations or modifications outside standard FortiVoice working directories
Administrative sessions originating from atypical source addresses immediately before file system anomalies

Detection Strategies

Inspect web server and application logs on FortiVoice appliances for path traversal patterns in POST and PUT request bodies and query parameters
Correlate authenticated administrative API calls with subsequent changes to system files, cron entries, or web root content
Alert on writes to sensitive paths such as /etc/, /bin/, web roots, or startup directories occurring outside scheduled maintenance windows

Monitoring Recommendations

Forward FortiVoice management access logs and audit trails to a centralized logging platform for retention and correlation
Baseline normal administrative file write behavior and alert on deviations involving privileged accounts
Monitor authentication events for privileged FortiVoice accounts and flag credential use from unusual geographies or hours

How to Mitigate CVE-2025-60024

Immediate Actions Required

Apply the fixed FortiVoice release identified in Fortinet advisory FG-IR-25-812 as soon as upgrade testing permits
Restrict access to the FortiVoice HTTP and HTTPS management interfaces to trusted administrative networks only
Rotate credentials for all privileged FortiVoice accounts and review recent administrative activity for signs of abuse
Enforce multi-factor authentication for administrative access to reduce risk from credential compromise

Patch Information

Fortinet has published remediation guidance in Fortinet Security Advisory FG-IR-25-812. Administrators should consult the advisory for the specific fixed build numbers for the 7.2.x and 7.0.x branches and upgrade affected appliances accordingly.

Workarounds

Limit administrative interface exposure using firewall access control lists that permit only known management subnets
Reduce the number of accounts assigned privileged FortiVoice roles to the minimum required for operations
Audit and remove unused administrative accounts and disable inactive sessions on the appliance

bash

# Example: restrict FortiVoice management interface access to a trusted subnet
# Apply at an upstream firewall; replace values with your environment specifics
iptables -A INPUT -p tcp -s 10.0.10.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp -s 10.0.10.0/24 --dport 80  -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP