IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
9.1Kritik KEV

CVE-2025-59718Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

Fortinet FortiSwitchManager; Fortinet FortiOS; Fortinet FortiProxy; Siemens RUGGEDCOM APE1808 Yayım: (11 ay önce)

Aktif olarak istismar ediliyor — Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 16.12.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 23.12.2025.

Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://fortiguard.fortinet.com/psirt/FG-IR-25-647 ; https://docs.fortinet.com/upgrade-tool/fortigate ; https://nvd.nist.gov/vuln/detail/CVE-2025-59718

Açıklama

A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Zayıflık türü (CWE): CWE-347

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Fortinet FortiOS 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.8, 7.2.0 – ≤ 7.2.11, 7.0.0 – ≤ 7.0.17
Fortinet FortiProxy 7.6.0 – ≤ 7.6.3, 7.4.0 – ≤ 7.4.10, 7.2.0 – ≤ 7.2.14, 7.0.0 – ≤ 7.0.21
Fortinet FortiSwitchManager 7.2.0 – ≤ 7.2.6, 7.0.0 – ≤ 7.0.5
Siemens RUGGEDCOM APE1808 0
siemens ruggedcom ape1808 firmware —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (11)
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.22
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.15
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.11
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.6.0 < 7.6.4
  • cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.6
  • cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.7
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.18
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.12
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.9
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.6.0 < 7.6.4
  • cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*

Aynı üründe son açıklar — Fortinet (all products)

9.1Kritik
CVE-2026-126229
Fortinet FortiManager; Fortinet FortiAnalyzer; Fortinet FortiManager Cloud; Fortinet FortiAnalyzer Cloud

A authorization bypass through user-controlled key vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer 7.0 all versions, FortiAna…

9.3Kritik
CVE-2026-126262
Fortinet FortiAnalyzer; Fortinet FortiManager

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, Fort…

7.7Yüksek
CVE-2026-121528
Fortinet FortiOS

A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a…

9.0Kritik
CVE-2026-126259
Fortinet FortiOS

A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP + standalone-config-sync, or aut…

6.3Orta
CVE-2026-121527
Fortinet FortiClientEMS

A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access…

7.4Yüksek
CVE-2026-126255
Fortinet FortiOS; Fortinet FortiPAM

A path traversal: '../filedir' vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, For…