CVE-2025-62631

Fortinet / FortiOS PUBLISHED

Description (CNA)

An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's password change under particular conditions outside of the attacker's control

Affected (CNA)

Vendor / product	Versions
Fortinet / FortiOS	affected 7.4.0; affected 7.2.0 through 7.2.13; affected 7.0.0 through 7.0.19; affected 6.4.0 through 6.4.16

CWE

CWE-613

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-411

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.