Loading vulnerability…
CVE-2025-24472 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy caused by insufficient implementation of authentication mechanisms in handling CSF proxy requests. A remote unauthenticated attacker who knows the upstream and downstream device serial numbers can send crafted CSF proxy requests to a downstream device and obtain super-admin privileges when Security Fabric is enabled. The issue affects FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. Successful exploitation can result in full administrative control of the affected appliance.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept exploit for CVE-2025-24472 affecting Fortinet FortiOS and FortiProxy. It contains two files: a README describing the vulnerability, affected versions, prerequisites, and mitigation guidance; and a single executable script, exploit.py, which is the main entry point. The exploit’s purpose is to achieve unauthenticated authentication bypass against the Fortinet CSF/Security Fabric interface. It targets the hardcoded endpoint /proxy/csf/v1/authenticate over HTTPS and sends a crafted POST request with spoofed trust-related headers and JSON fields. The script sets X-Fortinet-Serial, X-Forwarded-For, and Authorization headers to the supplied serial number, uses a FortiGate-CSF user agent, and requests fabric_role=super_admin with action=register. If the target returns HTTP 200 and the response contains the string "session", the script treats the target as successfully exploited and prints the returned JSON. Operationally, the script supports two modes: direct exploitation with a known serial number via --serial, or limited enumeration mode where it cycles through a built-in list of common/default Fortinet serials often seen in lab environments. The default port is 8443, but it is configurable. TLS certificate validation is disabled, indicating the script is intended for direct interaction with appliance management interfaces regardless of certificate trust. The code is simple and functional rather than framework-based. There is no post-exploitation automation beyond obtaining and printing the session-bearing response, so the repository is best characterized as an operational PoC for gaining super-admin session access rather than a full intrusion toolkit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
39 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in Fortinet appliances that Gunra ransomware affiliates exploit for initial access to internet-facing devices.
An authentication bypass vulnerability affecting FortiOS and/or FortiProxy that Gunra affiliates exploit to gain administrator access to exposed edge devices.
A high-severity authentication bypass vulnerability in FortiOS and FortiProxy that can let a remote unauthenticated attacker gain super-admin privileges on a downstream device when Security Fabric is enabled, using crafted CSF proxy requests and knowledge of device serial numbers.
A high-severity authentication bypass vulnerability affecting FortiOS and FortiProxy that has been weaponized in ransomware attacks.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.