🟡 CVE-2025-61624

CVE-2025-61624 is a path traversal vulnerability (CWE-22) in multiple Fortinet products including FortiOS, FortiProxy, FortiSwitchManager, and FortiPAM. Critically, the CVSS Attack Vector is LOCAL (not NETWORK), and exploitation requires an authenticated attacker with an admin profile and read-write CLI access, making direct unauthenticated internet exploitation impossible. Despite the products being internet-facing infrastructure, the LOCAL attack vector and authentication prerequisite significantly limit the T1190 internet exploitation risk; however, the vulnerability has been observed in the wild in post-access scenarios (e.g., PEERSTITCH malware deployment) enabling privilege escalation and persistent file manipulation on compromised devices.

← Back to Overview
MEDIUM_RISK
Risk Level
5.4
CVSS Score
LOCAL
Attack Vector
Privilege Escalation
ATT&CK Tactic
T1068 — Exploitation for Privilege Escalation
ATT&CK Technique
HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-04-14

Added to CISA KEV: 2026-10-16 185 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-10-16)

Summary

CVE-2025-61624 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability (CWE-22) affecting various Fortinet products, including FortiOS and FortiPAM. The vulnerability resides within the command-line interpreter (CLI), where inadequate canonicalization and validation allow an authenticated user with administrative privileges to write or delete arbitrary files outside of intended directories. This vulnerability is significant as it has been leveraged by threat actors to perform privilege escalation and deploy malicious implants, such as the PEERSTITCH malware, potentially leading to a complete compromise of the device's integrity and availability.

Exploitation

  • Active Exploitation: The vulnerability has been confirmed as being exploited in the wild [3].
  • Threat Actors/Campaigns: It has been utilized in campaigns involving the deployment of the ARM64 implant known as PEERSTITCH, often as part of a multi-stage attack to establish persistent access and intercept network traffic [1].
  • Proof-of-Concept: No specific public proof-of-concept code was detailed, though the vulnerability is understood to involve injecting relative path sequences (e.g., `../`) into CLI commands.
  • Prerequisites: Successful exploitation requires local or remote access to the administrative CLI and a valid administrative account with read-write permissions [2].

Affected Products & Patches

  • Affected Products:
* FortiOS: 7.6.0 through 7.6.4, 7.4.0 through 7.4.9, and all versions of 7.2, 7.0, and 6.4. * FortiPAM: 1.7.0, and all versions of 1.6, 1.5, 1.4, 1.3, and 1.2. * FortiProxy and FortiSwitchManager are also noted as affected components.
  • Patching: Organizations should refer to the official Fortinet PSIRT advisories for specific version patches or hotfixes addressing this flaw.
  • Mitigations: Apply security updates immediately and restrict access to the administrative CLI to trusted, authorized personnel only to limit the attack surface.

Impact

  • Access & Capability: Successful exploitation allows an authenticated attacker to write or delete arbitrary files on the system, which can be used to replace critical configuration files, scripts, or firmware with malicious versions [2].
  • Business Risk: For internet-facing deployments, this vulnerability presents a high business risk, as it can be used to establish persistent backdoors, facilitate network reconnaissance, intercept traffic, and enable unauthorized VPN sessions, leading to potential full-scale network compromise [1].

Sources

  1. PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged ...

    The stolen information was then used to conduct network reconnaissance, establish long-term access, intercept network traffic, set up unauthorized FortiGate SSL/VPN sessions to perimeter firewalls, deploy backdoors, and exploit a separate privilege-escalation vulnerability (i.e., CVE-2025-61624) to…

  2. CVE-2025-61624 - Vulnerability Details - OpenCVE

    This vulnerability is a path traversal flaw (CWE‑22) that allows an authenticated user with administrative CLI access to write or delete arbitrary files outside the intended protected directory. The attacker could replace critical configuration files, scripts, or firmware with malicious content, the…

  3. Multiple Vulnerabilities in Fortinet Products Could Allow ...

    CVE-2025-61624 has been exploited in the wild. A Path Traversal vulnerability … may allow an unauthenticated attacker to bypass authentication ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed