CVE-2025-22251

Fortinet / FortiOS PUBLISHED

Description (CNA)

An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.

Affected (CNA)

Vendor / product	Versions
Fortinet / FortiOS	affected 7.6.0; affected 7.4.0 through 7.4.5; affected 7.2.0 through 7.2.11; affected 7.0.0 through 7.0.17; affected 6.4.0 through 6.4.16

CWE

CWE-923

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-287

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.