CVE-2025-54821 is an Improper Privilege Management vulnerability (CWE-269) identified in Fortinet FortiProxy and several Fortinet FortiOS and FortiPAM versions. The flaw exists in FortiProxy versions 7.0.0 through 7.6.3 and corresponding FortiOS and FortiPAM versions, allowing an authenticated administrator to bypass the trusted host policy via specially crafted CLI commands. The trusted host policy is designed to restrict administrative access to specific IP addresses or hosts, serving as an additional security layer. By circumventing this policy, an attacker with administrative credentials can potentially perform administrative actions from unauthorized hosts, increasing the risk of lateral movement or unauthorized configuration changes. The vulnerability requires the attacker to already have administrator-level privileges and local access to the CLI, limiting the attack surface. The CVSS v3.1 base score is 1.8, reflecting low severity due to the high privilege requirement, high attack complexity, and lack of confidentiality or availability impact. No known exploits have been reported in the wild, and no patches were linked at the time of publication. The vulnerability affects a broad range of Fortinet products widely used in enterprise and service provider environments for secure web gateway, proxy, and access management functions.

For European organizations, the primary impact of CVE-2025-54821 is the potential for unauthorized administrative actions if an attacker with existing admin credentials exploits the trusted host policy bypass. This could lead to unauthorized configuration changes, weakening network security postures or enabling further attacks such as data interception or lateral movement within networks. Although the vulnerability does not directly compromise confidentiality or availability, the erosion of administrative controls can indirectly increase risk exposure. Organizations relying heavily on FortiProxy and FortiOS for perimeter security, web filtering, and access management could see increased risk if administrative access controls are circumvented. Critical infrastructure sectors, government agencies, and large enterprises with complex network environments are particularly sensitive to such privilege escalation issues. However, the requirement for high privileges and local access reduces the likelihood of widespread exploitation. The absence of known exploits in the wild further lowers immediate risk but does not eliminate the need for vigilance.

1. Monitor Fortinet advisories closely and apply official patches or updates as soon as they become available to address CVE-2025-54821. 2. Restrict administrative access to FortiProxy and related Fortinet devices strictly to trusted networks and personnel using network segmentation and access control lists (ACLs). 3. Implement multi-factor authentication (MFA) for all administrative accounts to reduce the risk of credential compromise. 4. Regularly audit administrative accounts and CLI access logs to detect any anomalous or unauthorized activity. 5. Employ role-based access control (RBAC) to limit administrative privileges to the minimum necessary for each user. 6. Use network-level protections such as VPNs and IPsec tunnels for administrative access to reduce exposure. 7. Conduct periodic security training for administrators on secure CLI usage and the risks of privilege escalation. 8. Consider deploying intrusion detection/prevention systems (IDS/IPS) to monitor for suspicious CLI commands or access patterns targeting Fortinet devices.