This vulnerability (CVE-2025-24472) is an authentication bypass using an alternate path or channel (CWE-288) in Fortinet FortiOS and FortiProxy products. It affects FortiOS versions 7.0.0 through 7.0.16 and FortiProxy versions 7.2.0 through 7.2.12 and 7.0.0 through 7.0.19. An attacker with prior knowledge of the serial numbers of upstream and downstream devices can exploit this flaw to gain super-admin privileges on the downstream device if the Security Fabric feature is enabled. The attack vector involves sending specially crafted CSF proxy requests. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. Fortinet has released an official fix to address this issue.

Successful exploitation allows a remote unauthenticated attacker to bypass authentication and gain super-admin privileges on a downstream device within the Security Fabric. This grants full control over the affected device, potentially compromising confidentiality, integrity, and availability of the system and network.

An official fix is available from Fortinet to remediate this vulnerability. Users should apply the vendor-provided patches promptly to affected FortiOS and FortiProxy versions. Since the vulnerability requires Security Fabric to be enabled and knowledge of device serial numbers, reviewing and restricting access to such information may reduce risk but does not replace patching.