CVE-2025-24471

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24471
An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fortiguard.fortinet.com/psirt/FG-IR-24-544 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:fortinet:fortisase:25.1.39:*:*:*:-:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
History

22 Jul 2025, 17:57

Type Values Removed Values Added
References () https://fortiguard.fortinet.com/psirt/FG-IR-24-544 - () https://fortiguard.fortinet.com/psirt/FG-IR-24-544 - Vendor Advisory
First Time Fortinet fortios
Fortinet fortisase
Fortinet
CPE cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisase:25.1.39:*:*:*:-:*:*:*

12 Jun 2025, 16:06

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de validación de certificado incorrecta [CWE-295] en FortiOS versión 7.6.1 y anteriores, versión 7.4.7 y anteriores puede permitir que un usuario remoto verificado por EAP se conecte desde FortiClient a través de un certificado revocado.

10 Jun 2025, 17:21

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-10 17:21

Updated : 2025-07-22 17:57

NVD link : CVE-2025-24471

Mitre link : CVE-2025-24471

CVE.ORG link : CVE-2025-24471

JSON object : View

Products Affected

fortinet

  • fortios
  • fortisase
CWE
CWE-295

Improper Certificate Validation