Fortinet Fixes High-Privilege Path Traversal Flaw Across FortiOS and Enterprise Products

Administrative CLI interfaces across several Fortinet operating systems are subject to a path traversal vulnerability tracked as CVE-2025-61624. The flaw allows an authenticated administrator with read-write privileges to write or delete arbitrary files on the system via crafted command-line arguments. Affected software families include FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager.

Technical Details and Impact

The issue lies in improper pathname validation (CWE-22) when processing specific CLI commands. While administrative interfaces on enterprise appliances typically isolate users within restricted management shells, an arbitrary file write or deletion flaw breaks these sandbox boundaries.

The underlying severity is reflected in its CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H), carrying a score of 6.0. High privileges are required to reach the vulnerable code path, and exploitation requires direct local or console/SSH CLI access (AV:L). However, once an attacker reaches this context, attack complexity is low and no user interaction is required. The primary impact is to system integrity and availability: an adversary can overwrite critical system binaries, alter configuration state, or delete essential system files to disable security controls or cause a localized denial-of-service condition.

Risk and Exposure Analysis

Because exploitation demands high-privilege administrative access, widespread automated attack activity is unlikely in the short term. This context is reflected in the threat metrics, where the Exploit Prediction Scoring System (EPSS) measures the 30-day exploitation probability at 0.58% (putting it in the 46.6th percentile among all tracked vulnerabilities).

However, in post-exploitation scenarios, path traversal flaws in perimeter devices hold significant value for sophisticated threat actors. Adversaries who gain administrative credentials through credential dumping, phishing, or prior access trade can leverage CVE-2025-61624 to achieve shell escape, tamper with local logging binaries, or establish persistent footholds on core network infrastructure. Appliances exposed directly to management networks or managed through shared administrative consoles face elevated risk if access controls are not strictly enforced.

Remediation Guidance

Organizations running affected products should update to patched release trains as outlined in advisory FG-IR-26-122:

• FortiOS: Upgrade to 7.4.10, 7.6.5, or later (affects 6.4.x, 7.0.x, 7.2.x, 7.4.x prior to 7.4.10, and 7.6.x prior to 7.6.5).
• FortiProxy: Upgrade to 7.4.12, 7.6.5, or later.
• FortiPAM: Upgrade to 1.7.1 or later.
• FortiSwitchManager: Upgrade to 7.0.7 or later.

Where immediate patching is delayed, access to appliance administrative interfaces (SSH, serial console, and web-based CLI access) must be tightly restricted to trusted management subnets via dedicated access control lists (ACLs) and out-of-band jump hosts. Administrative roles should follow least-privilege principles, revoking full read-write CLI capabilities from operational profiles that do not specifically require them.