CVE-2025-25255
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, Fo
Severity
Medium 4.8
CVSS 3.1
Exploited
Not listed
EPSS
0.004
32.6th percentile
Discovered by
Not disclosed
Published
Oct 14, 2025
Assigned by fortinet
Description
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0.1 through 7.0.22 may allow an unauthenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.
Weakness: CWE-358
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiOS | Firewall / NGFW | cna-assigner |
| Fortinet | FortiProxy | SASE / SSE / Secure Web | cna-assigner |
Vendor-reported affected versions (2)
- Fortinet · FortiOS
- Fortinet · FortiProxy
Vendor remediation
Upgrade to FortiOS version 7.6.4 or above Upgrade to FortiProxy version 7.6.4 or above Upgrade to FortiProxy version 7.4.12 or above