PT-2025-24716 · Fortinet · Fortios

Published 2025-06-10 · Updated 2025-07-22 · CVE-2025-24471

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.1 and below FortiOS versions 7.4.7 and below

Description The issue is related to an Improper Certificate Validation, which may allow an EAP verified remote user to connect from FortiClient via a revoked certificate.

Recommendations For FortiOS versions 7.6.1 and below, update to a version above 7.6.1 to resolve the issue. For FortiOS versions 7.4.7 and below, update to a version above 7.4.7 to resolve the issue. As a temporary workaround, consider restricting access to the EAP verified remote connection feature until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-12653

CVE-2025-24471

Affected Products

Fortios

References · 8

• https://osv.dev/vulnerability/CVE-2025-24471 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-24-544 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12653 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24471 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24471 · Security Note
• https://twitter.com/CVEnew/status/1932512989967708624 · Twitter Post
• https://fortiguard.com/psirt/FG-IR-24-544 · Note
• https://t.me/cveNotify/129875 · Telegram Post