CVE-2025-25255
📊 4.3 MEDIUM⚡ 0.0%🎯 0 exploits
📅 Published Oct 14, 2025
📋 Status: Analyzed
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0.1 through 7.0.21, and FortiOS 7.6.0 through 7.6.3 explicit web proxy may allow an authenticated proxy user to bypass the domain fronting protection feature via crafted HTTP requests.
CVSS v3.1 • [email protected]
🎯 Affected Products & Systems
2 product configurations affected
Filter by type:
| Type | Vendor | Product | Version Range | Status | CPE String |
|---|---|---|---|---|---|
📱App | fortinet | fortiproxy | ≥ 7.0.1 ∧ < 7.6.4 | Vulnerable | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* |
💻OS | fortinet | fortios | ≥ 7.6.0 ∧ < 7.6.4 | Vulnerable | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
📱
VulnerableApplication
Version: ≥ 7.0.1 ∧ < 7.6.4
CPE:
cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector:
NETWORK
Complexity:
LOW
Privileges:
LOW
User Interaction:
NONE
Confidentiality:
NONE
Integrity:
LOW
Availability:
NONE
Scope:
UNCHANGED
🔍 Technical Details
Analysis Status
AnalyzedCVSS Details
4.3 (MEDIUM)v3.1
Source: [email protected]
EPSS Details
0.0% (Minimal)11.7th percentile
Last updated: Oct 31, 2025
Exploitation probability within 30 days
Published Date
Oct 14, 2025 (19 days ago)
Last Modified
Oct 16, 2025 (17 days ago)
Security Weaknesses1
CWE-358
References2
NVDgeneral