جزئیات آسیب‌پذیری
CVE-2025-61624
بهره‌برداری فعالشرح رسمی (انگلیسی)
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 5.4متوسط | 3.1 | CVEProject cvelistV5 (CNA) (fortinet) | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Fortinet | FortiOS | 6.4.0 ≤ v ≤ 6.4.16 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiOS | 7.0.0 ≤ v ≤ 7.0.19 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiOS | 7.2.0 ≤ v ≤ 7.2.13 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiOS | 7.4.0 ≤ v ≤ 7.4.9 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiOS | 7.6.0 ≤ v ≤ 7.6.4 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.2.0 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.7.0 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.0.0 ≤ v ≤ 1.0.3 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.1.0 ≤ v ≤ 1.1.2 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.3.0 ≤ v ≤ 1.3.1 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.4.0 ≤ v ≤ 1.4.3 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.5.0 ≤ v ≤ 1.5.1 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiPAM | 1.6.0 ≤ v ≤ 1.6.2 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiProxy | 7.0.0 ≤ v ≤ 7.0.23 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiProxy | 7.2.0 ≤ v ≤ 7.2.16 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiProxy | 7.4.0 ≤ v ≤ 7.4.11 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiProxy | 7.6.0 ≤ v ≤ 7.6.4 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiSwitchManager | 7.0.0 ≤ v ≤ 7.0.6 | CVEProject cvelistV5 (CNA) |
| Fortinet | FortiSwitchManager | 7.2.0 ≤ v ≤ 7.2.7 | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM APE1808 | همه | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۴- https://fortiguard.fortinet.com/psirt/FG-IR-26-122
- https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/#post-188095-_guyq53ar8k05 third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624 government-resource
- https://cert-portal.siemens.com/productcert/html/ssa-975644.html
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۱/۲۵
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۷/۲۵
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- fortinet
فهرست KEV آژانس CISA
- تاریخ افزوده‌شدن
- ۱۴۰۵/۰۷/۲۴
- مهلت رفع
- ۱۴۰۵/۰۷/۲۷
- استفاده در باج‌افزار
- نامشخص
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- فعال
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-22Escalation of privilege