CVE-2025-22252

highpriority · track · 29OT risk · elevatedEPSS 0.009 · 61 %ileDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.95% (61st) EPSS

CVSS 7.2 · high

Is it mine?

29 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-26

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4.4 through 7.4.6 and version 7.6.0 may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRUGGEDCOM APE1808siemens_psirt
Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information
FixedRUGGEDCOM APE1808cisa_csaf_ot
Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information
MitigationRUGGEDCOM APE1808siemens_psirt
Use alternate authentication mechanism such as PAP, MSCHAP, and CHAP configurations other than ASCII authentication (see https://www.fortiguard.com/psirt/FG-IR-24-472)
MitigationRUGGEDCOM APE1808cisa_csaf_ot
Use alternate authentication mechanism such as PAP, MSCHAP, and CHAP configurations other than ASCII authentication (see https://www.fortiguard.com/psirt/FG-IR-24-472)

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.6–9.8

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.2 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:Csecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · psirt@fortinet.comexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:Csecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306USCWE-306USCWE-306US

affected products (29)

Products and version ranges known to be affected.

Fortinet FortiOS <7.4.7all versionscert_bundDE
Fortinet FortiOS <7.6.1all versionscert_bundDE
Fortinet FortiProxy <7.6.2all versionscert_bundDE
Fortinet FortiSwitch <7.2.6all versionscert_bundDE
Fortinet FortiOS< 7.4.7cert_bundDE
Fortinet FortiOS< 7.6.1cert_bundDE
Fortinet FortiProxy< 7.6.2cert_bundDE
Fortinet FortiSwitch< 7.2.6cert_bundDE
RUGGEDCOM APE1808all versionscisa_csaf_otUS
Siemens RUGGEDCOM APE1808≤ vers:all/*cisa_csaf_otUS
Fortinet FortiOS≤ 7.6.0enisa_euvdEU
Fortinet FortiOS≤ 7.4.4 ≤7.4.6enisa_euvdEU
Fortinet FortiProxy≤ 7.6.0 ≤7.6.1enisa_euvdEU
Fortinet FortiSwitchManager≤ 7.2.5enisa_euvdEU
Fortinet Inc. FortiOS≤ 7.6.0fstec_bduRU
Fortinet Inc. FortiOS7.4.4 → 7.4.6fstec_bduRU
Fortinet Inc. FortiProxy7.6.0 → 7.6.1fstec_bduRU
Fortinet Inc. FortiSwitchManager≤ 7.2.5fstec_bduRU
Fortinet FortiAnalyzer≤ vers:unknown/unknownncsc_nlNLcpe:/a:fortinet:fortianalyzer:-
Fortinet FortiManager≤ vers:unknown/unknownncsc_nlNLcpe:/a:fortinet:fortimanager:-

showing 20 of 29

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2025-0166Kwetsbaarheden verholpen in Fortinet productenNL2025-05-14csaf · ncsc_nlNL
Fortinet heeft kwetsbaarheden verholpen in FortiManager, FortiManager Cloud, FortiAnalyzer, FortiOS, FortiProxy, FortiPAM, FortiSRA, FortiSwitchManager en FortiWeb.
SSA-770770SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices2025-02-11csaf · siemens_psirtDE
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
WID-SEC-W-2025-1026Fortinet FortiOS, FortiProxy und FortiSwitch: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2025-05-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Fortinet FortiOS, Fortinet FortiProxy und Fortinet FortiSwitch ausnutzen, um seine Privilegien zu erhöhen.
ICSA-25-044-06Siemens RUGGEDCOM APE18082025-02-11icsa · cisa_csaf_otUS
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2025-05-28modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan