CVE-2025-24472: Super-Admin Authentication Bypass in Fortinet FortiOS & FortiProxy (CSF Proxy)

HERMES

HERMES THREAT SCORE & FIREWALL PERIMETER EXPOSURE

Target: Fortinet FortiOS 7.0 & FortiProxy 7.0 / 7.2 (Security Fabric CSF)

Confidence: 98%

92 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 19 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 19 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-24472 at an HTS of 92 (CRITICAL SEVERITY). This vulnerability in the Cooperative Security Fabric (CSF) protocol allows remote attackers with knowledge of device serial numbers to impersonate upstream security fabric coordinators and gain super-admin control over downstream FortiGate devices.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-24472: Super-Admin Authentication Bypass in Fortinet FortiOS & FortiProxy (CSF Proxy)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTFortinet FortiOS Gateway

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Fortinet FortiOS Gateway documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Identification

Parameter	Technical Specification	Operational Impact
CVE Identifier	`CVE-2025-24472`	Official NVD / MITRE record
Vendor Advisory	FG-IR-24-535	Official FortiGuard PSIRT Advisory
Associated CWE	`CWE-288`: Authentication Bypass Using an Alternate Path or Channel	Unauthorized super-admin privilege grant via CSF channel
CVSS v3.1 Score	8.1 HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS v4.0 Score	8.6 HIGH	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
Applicable CPEs	`cpe:2.3:o:fortinet:fortios::::::::` `cpe:2.3:a:fortinet:fortiproxy::::::::`	Enterprise firewalls and secure web proxies
Affected Versions	FortiOS 7.0.0 through 7.0.16; FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19	Devices with Cooperative Security Fabric (CSF) enabled
Fixed Versions	FortiOS 7.0.17, 7.2.0+, 7.4.0+; FortiProxy 7.2.13, 7.0.20	Official firmware upgrade packages

2. Exploitation

CISA KEV: Added on March 18, 2025; active ransomware use confirmed.
EPSS Score: 0.07106 (Percentile: 93.8%).
Operational Status: Confirmed in-the-wild exploitation targeting enterprise fabric topologies.
PoC & Weaponization: Forged CSF proxy requests directed to management ports (TCP 8013 / 8014).
Access Conditions: Pre-authentication; requires prior knowledge of upstream/downstream serial numbers; network access to CSF listener; medium complexity.

3. Threat Intelligence

Threat Actors: Nation-state cyber espionage groups (Volt Typhoon, Flax Typhoon) and ransomware affiliates.
Observed Campaigns: Disabling perimeter threat inspection, creating shadow VPN accounts, and harvesting internal configurations.
Associated Malware: Custom ELF implants for FortiOS hardware architectures and persistent tunneling scripts.
Exploitation Timeline: Published by Fortinet on March 18, 2025, noting pre-patch in-the-wild exploitation.

4. Detection & Forensic Triage

Indicators of Compromise (IOCs)

Anomalous CSF Traffic: CSF connections on TCP 8013 originating from external or unexpected WAN IP addresses.
Spurious Super-Admin Accounts: Unexpected administrative accounts created via CSF or API channels.

Sigma Rule

title: Abnormal FortiOS CSF Proxy Activity (CVE-2025-24472)
id: d7e6f5a4-2447-4f89-8b01-998877665544
status: test
description: Detects abnormal CSF proxy requests or administrative logins bypassing standard FortiOS authentication
references:
  - https://fortiguard.fortinet.com/psirt/FG-IR-24-535
author: Hermes Codex Research
date: 2026-09-10
logsource:
  product: fortios
  service: event
detection:
  selection:
    logid:
      - '0100032200' # Admin login successful
      - '0100032201' # Admin login failed
    ui: 'csf'
    status: 'success'
  filter:
    srcip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate Security Fabric synchronization across authorized management subnets
level: critical

YARA Signature

rule Exploit_Fortinet_CSF_Proxy_Bypass_CVE_2025_24472 {
    meta:
        description = "Detects packets and scripts exploiting Fortinet CSF Proxy bypass"
        author = "Hermes Codex Research"
        date = "2026-09-10"
        reference = "CVE-2025-24472"
    strings:
        $csf_token = "csf-proxy" ascii nocase
        $serial_prefix = "FGT" ascii
        $super_admin = "super_admin" ascii
        $csf_proto = { 08 00 00 00 13 80 } // CSF communication frame
    condition:
        ($csf_token and $serial_prefix and $super_admin) or $csf_proto
}

Suricata / Snort Signature

alert tcp $EXTERNAL_NET any -> $FORTIGATE_DEVICES [8013,8014] (msg:"HERMES - Fortinet CSF Proxy Authentication Bypass Attempt (CVE-2025-24472)"; flow:to_server,established; content:"csf-proxy"; nocase; classtype:attempted-admin; sid:202524472; rev:1;)

Logs & Forensic Artifacts

FortiOS Event Logs: Filter for logid=0100032200 where ui=csf originates from unauthorized external hosts.
CLI Debugging: Check command history via diag debug cli 8 for configuration modifications performed over CSF.
MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1078.001 (Default Accounts), T1098 (Account Manipulation), T1562.001 (Disable or Modify Tools).

5. Remediation & Hardening

Upgrade Firmware Immediately: Upgrade to FortiOS 7.0.17 or migrate to supported releases in the 7.2 or 7.4 streams.
Temporarily Disable Security Fabric: If upgrading immediately is unfeasible, disable CSF on downstream devices via CLI: config system csf -> set status disable -> end.
Apply Local-In Firewall Policies: Restrict TCP ports 8013 and 8014 strictly to authorized internal peers.
Audit Administrator Accounts: Inspect configured accounts (get system admin list) and remove any unverified super-admin credentials.
Rotate Fabric Pre-Shared Keys: Re-generate encryption secrets between Security Fabric cluster members.

6. Enterprise Impact Scenario

”What happens if this vulnerability is exploited in an enterprise?”
Section titled “”What happens if this vulnerability is exploited in an enterprise?””

Serial Number Reconnaissance: The attacker obtains firewall serial numbers through OSINT, compromised configuration files, or exposed SNMP services.

Forged CSF Request Delivery: The adversary crafts CSF proxy requests directed to TCP port 8013 on a branch FortiGate, spoofing the headquarters root firewall.

Super-Admin Rights Grant: The flawed CSF daemon accepts the forged frame and grants the attacker full super_admin privileges on the branch appliance without requiring credentials.

Defensive Control Dismantling: The attacker disables IPS inspection, disables AV file blocking, and adds shadow administrator accounts.

Internal Subnet Infiltration: Controlling the perimeter device, the threat actor establishes backdoor VPN tunnels, pivots across corporate VLANs, and facilitates enterprise-wide ransomware execution.