Product:
FortiOS
Summary
An Improper Verification of Source of a Communication Channel vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and all versions of 7.2 and 7.0. This vulnerability may allow an authenticated user with knowledge of FSSO policy configurations to gain unauthorized access to protected network resources through crafted requests.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.2 | CVE-2025-62439 |
Exploitation
To exploit this vulnerability, an attacker must be an authenticated user who understands the FSSO policy configurations. By crafting specific requests, the attacker can bypass security measures and access protected network resources that should otherwise be restricted.
Affected Products
- FortiOS 7.6.0 to 7.6.4: Vulnerable to unauthorized access through crafted requests.
- FortiOS 7.4.0 to 7.4.9: Similar vulnerability allowing unauthorized access.
- FortiOS 7.2: All versions are affected by this vulnerability.
- FortiOS 7.0: All versions are also vulnerable.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of FortiOS that addresses this issue. Additionally, reviewing and tightening FSSO policy configurations can help prevent unauthorized access.