CVE-2025-25248

En bref

Sévérité: MEDIUM 4.8
EPSS: EPSS 0.48 % · centile 42 (2026-10-27)
État: PUBLISHED
Publiée: 2025-08-12
Mise à jour: 2026-10-15
Attribuée par: fortinet
Statut NVD: Modified

Description

An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.8	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R	fortinet
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	NVD · psirt@fortinet.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-190

Références européennes

ENISA EUVD · EUVD-2025-24459
GCVE · GCVE-0-2025-25248

Avis du CERT-FR

CERTFR-2025-AVI-0679 — Multiples vulnérabilités dans les produits Fortinet · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 7.2.11
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.8
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.6.0 < 7.6.3
cpe:2.3:o:fortinet:fortipam:*:*:*:*:*:*:*:* ≥ 1.0.0 < 1.4.3
cpe:2.3:o:fortinet:fortipam:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 < 7.4.4
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.6.0 < 7.6.3

Produits affectés

Produit	Versions
Fortinet · FortiOS	affected 7.6.0 ≤ 7.6.2 ; affected 7.4.0 ≤ 7.4.7 ; affected 7.2.0 ≤ 7.2.10 ; affected 7.0.0 ≤ 7.0.17 ; affected 6.4.0 ≤ 6.4.16
Fortinet · FortiPAM	affected 1.5.0 ; affected 1.4.0 ≤ 1.4.2 ; affected 1.3.0 ≤ 1.3.1 ; affected 1.2.0 ; affected 1.1.0 ≤ 1.1.2 ; affected 1.0.0 ≤ 1.0.3
Fortinet · FortiProxy	affected 7.6.0 ≤ 7.6.2 ; affected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.14 ; affected 7.0.0 ≤ 7.0.21 ; affected 2.0.0 ≤ 2.0.14

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD