Is CVE-2025-24471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-24471 being exploited in the wild.

How severe is CVE-2025-24471?

Medium severity, with a CVSS score of 6.5, published 10 June 2025.

Which products and versions are affected?

Fortinet FortiGate NGFW Versions with Fortigate NGFW < V7.4.9 or < V7.6.6; Fortinet FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.7; Fortinet Fortisase 25.1.a.2; Siemens Ruggedcom Ape1808 Versions with Fortigate NGFW < V7.4.9 or < V7.6.6.

Is there a fix for CVE-2025-24471?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-24471 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-24471?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-24471: Fortinet FortiOS Improper Certificate Validation in EAP authentication

Q: Is there a fix for CVE-2025-24471?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-24471 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2025-24471?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-24471 · Severity: medium · CVSS 6.5 · Published 2025-06-10

A security flaw in Fortinet's operating system for firewalls and networking devices could allow unauthorized access to the corporate network. Specifically, a remote user whose digital security certificate has been revoked (cancelled) can still successfully connect to the network using the FortiClient VPN software. This undermines the ability of administrators to immediately block access for former employees or compromised accounts.

Technologies: Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase, Siemens Ruggedcom Ape1808. Vendors: Fortinet, Siemens.

Quick answers

Is CVE-2025-24471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-24471 being exploited in the wild.
How severe is CVE-2025-24471?: Medium severity, with a CVSS score of 6.5, published 10 June 2025.
Which products and versions are affected?: Fortinet FortiGate NGFW Versions with Fortigate NGFW < V7.4.9 or < V7.6.6; Fortinet FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.7; Fortinet Fortisase 25.1.a.2; Siemens Ruggedcom Ape1808 Versions with Fortigate NGFW < V7.4.9 or < V7.6.6.
Is there a fix for CVE-2025-24471?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-24471 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-24471?: Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortisase or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Improper Certificate Validation vulnerability (CWE-295) exists in the EAP (Extensible Authentication Protocol) implementation of FortiOS. The root cause is a failure to properly check the revocation status of certificates during the authentication handshake. A remote attacker with a valid but revoked certificate can bypass intended access controls to establish a connection via FortiClient. The vulnerability is reachable over the network and requires the attacker to possess a certificate that was previously trusted. Fortinet has released patches in FortiOS versions 7.6.2 and 7.4.8 to address this issue.

Affected products

Fortinet FortiOS 7.6.0 through 7.6.1, 7.4.0 through 7.4.7
Fortinet FortiSASE 25.1.a.2
Siemens RUGGEDCOM APE1808 (Fortigate NGFW) Versions with Fortigate NGFW < V7.4.9 or < V7.6.6

Timeline

2025-05-13: advisory: Siemens published initial advisory SSA-864900
2025-06-10: disclosed: Initial publication by Fortinet (FG-IR-24-544) and NVD listing

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.