Skip to content
Back to search

CVE-2025-61624

MEDIUM
6.0 CISA KEVNVD

Summary

generated automatically from NVD data

CVE-2025-61624 is a path traversal flaw (CWE-22) in Fortinet FortiOS, FortiPAM, FortiProxy and FortiSwitchManager; the data also lists Siemens RUGGEDCOM APE1808 firmware. An authenticated attacker with an admin profile and at least read-write permissions could use specific CLI commands to write or delete arbitrary files. It is rated 6.0 (MEDIUM, CVSS v3.1) and is listed in the CISA KEV catalog, which marks it as actively exploited.

NVD description

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

Share:

⚠️ Actively exploited — CISA KEV

This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-10-16. It is confirmed exploited in the wild and must be patched as a priority.

Remediation deadline (US federal agencies): 2026-10-19

EPSS · FIRST.org

0.58%probability of exploitation in the next 30 days

Higher than 46% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.

CVSS v3.1 Score

6.0
/ 10.0
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Information

Published
14 avr. 2026
Updated
17 oct. 2026
Status
Analyzed
Source
psirt@fortinet.com

Affected products

fortinet fortiosAll Fortinet FortiOS CVEs →
Versions : 7.4.10, 7.6.5
fortinet fortipam
Versions : 1.7.1
fortinet fortiproxy
Versions : 7.4.12, 7.6.5
fortinet fortiswitchmanager
Versions : 7.0.7, 7.2.8
siemens ruggedcom ape1808 firmware

Weaknesses (CWE)

CWE-22

References (4)

Similar CVEs

Other vulnerabilities of type CWE-22

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring