PT-2025-28465 · Fortinet · Fortianalyzer+3

Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-24474

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: FortiManager versions 6.4 through 7.6.1 FortiManager Cloud versions 6.4 through 7.4.6 FortiAnalyzer versions 6.4 through 7.6.1 FortiAnalyzer Cloud versions 6.4 through 7.4.6

Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This may allow an authenticated attacker with high privilege to extract database information via crafted requests.

Recommendations: For FortiManager versions 6.4 through 7.6.1, update to a version that includes a fix for this issue. For FortiManager Cloud versions 6.4 through 7.4.6, update to a version that includes a fix for this issue. For FortiAnalyzer versions 6.4 through 7.6.1, update to a version that includes a fix for this issue. For FortiAnalyzer Cloud versions 6.4 through 7.4.6, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to sensitive database information to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-09544

CVE-2025-24474

Affected Products

Fortianalyzer

Fortianalyzer Cloud

Fortimanager

Fortimanager Cloud

References · 5

• https://fortiguard.fortinet.com/psirt/FG-IR-24-437 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09544 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24474 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24474 · Vendor Advisory
• https://twitter.com/CVEnew/status/1942598374764544039 · Twitter Post