What is CVE-2025-22254?

CVE-2025-22254 is a medium-severity vulnerability in Fortinet Fortios, classified under Improper Privilege Management. CVSS score: 6.6/10. Published 2025-06-10.

How severe is CVE-2025-22254?

Medium severity. CVSS v3 base score is 6.6 out of 10.

Privilege escalation in Fortinet Fortios

CVE-2025-22254

An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiWeb 7.6.0 through 7.6.1, FortiWeb 7.4.0 through 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to Node.js websocket module.

Vulnerability class: Privilege Escalation

EPSS: 0.007 (49.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortios — versions 7.6.0, 7.4.0, 7.2.0
Fortinet Fortiproxy — versions 7.6.0, 7.4.0
Fortinet Fortiweb — versions 7.6.0, 7.4.0

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-22254?: CVE-2025-22254 is a medium-severity vulnerability in Fortinet Fortios, classified under Improper Privilege Management. CVSS score: 6.6/10. Published 2025-06-10.
How severe is CVE-2025-22254?: Medium severity. CVSS v3 base score is 6.6 out of 10.