Fortinet FortiOS/FortiProxy Path Traversal Vulnerability Advisory (CVE-2025-61624)

The primary remediation is to upgrade the firmware to the following secure versions:

1. Firmware Upgrade Paths

• FortiOS: Update to 7.6.5, 7.4.10 or higher.
• FortiProxy: Update to 7.6.5, 7.4.12 or higher.
• FortiPAM: Update to 1.7.1 or higher.
• FortiSwitchManager: Update to 7.2.8 or higher.

2. Temporary Mitigation (If patching is delayed)

Restrict administrative access to the CLI using Trusted Hosts (ACLs) to ensure only authorized IP addresses can manage the device.

config system admin
    edit <admin_user>
        set trusthost1 <trusted_ip_address> <netmask>
    next
end

Additionally, audit administrative logs for unusual CLI command execution related to file system operations.

CVE-2025-61624 is a Path Traversal vulnerability (CWE-22) residing in the CLI of various Fortinet products. It stems from improper limitation of pathnames to restricted directories. While the exploit requires an authenticated session with high privileges (admin profile with read-write permissions), its inclusion in the CISA KEV catalog and an EPSS score of 0.94 indicate high real-world exploitation activity. Attackers typically leverage this flaw in post-exploitation phases to modify system configurations, plant backdoors, or delete forensic evidence (logs) by manipulating arbitrary files on the underlying filesystem.