Is CVE-2025-25248 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-25248 being exploited in the wild.

How severe is CVE-2025-25248?

Medium severity, with a CVSS score of 5.3, published 12 August 2025.

Which products and versions are affected?

Fortinet FortiGate NGFW Versions with Fortigate NGFW < V7.4.9; Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions; Fortinet Fortipam 1.5.0, 1.4.0 through 1.4.2, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; Fortinet FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.3, 7.2 all versions, 7.0 all versions, 2.0 all versions; and 1 more.

Is there a fix for CVE-2025-25248?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-25248 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-25248?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortipam or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-25248: Fortinet FortiOS and FortiProxy integer overflow in SSL-VPN bookmarks

Q: Is there a fix for CVE-2025-25248?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-25248 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2025-25248?

Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortipam or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-25248 · Severity: medium · CVSS 5.3 · Published 2025-08-12

A vulnerability exists in several Fortinet networking products, including FortiOS and FortiProxy, which provide secure remote access and firewall services. An authenticated user could exploit this flaw to crash the SSL-VPN service, preventing other employees from connecting to the corporate network. This impact is limited to service availability and does not directly result in the theft of sensitive data.

Technologies: Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortipam, Fortinet FortiProxy, Siemens Ruggedcom Ape1808. Vendors: Fortinet, Siemens.

Quick answers

Is CVE-2025-25248 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-25248 being exploited in the wild.
How severe is CVE-2025-25248?: Medium severity, with a CVSS score of 5.3, published 12 August 2025.
Which products and versions are affected?: Fortinet FortiGate NGFW Versions with Fortigate NGFW < V7.4.9; Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions; Fortinet Fortipam 1.5.0, 1.4.0 through 1.4.2, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions; Fortinet FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.3, 7.2 all versions, 7.0 all versions, 2.0 all versions; and 1 more.
Is there a fix for CVE-2025-25248?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-25248 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-25248?: Check whether you run Fortinet FortiGate NGFW, Fortinet FortiOS, Fortinet Fortipam or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow or wraparound vulnerability (CWE-190) exists within the SSL-VPN RDP and VNC bookmarking components of FortiOS, FortiProxy, and FortiPAM. The flaw is triggered when the system processes specially crafted requests related to these bookmarks. An attacker must be authenticated to the SSL-VPN portal to exploit this vulnerability. Successful exploitation allows the attacker to affect the availability of the SSL-VPN service, leading to a denial-of-service (DoS) condition. Fortinet has released patches for various branches, including FortiOS 7.6.3, 7.4.8, and 7.2.11.

Affected products

Fortinet FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, 7.0 all versions, 6.4 all versions
Fortinet FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.3, 7.2 all versions, 7.0 all versions, 2.0 all versions
Fortinet FortiPAM 1.5.0, 1.4.0 through 1.4.2, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions
Siemens RUGGEDCOM APE1808 (Fortigate NGFW) Versions with Fortigate NGFW < V7.4.9

Timeline

2025-08-12: disclosed: Initial publication by Fortinet
2025-08-12: advisory: Fortinet advisory FG-IR-24-364 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.