External risk intelligence

Fortinet Path Traversal File Write Delete Vulnerability

CVE advisoryKnown Exploit

CVE-2025-61624

The affected products include network security appliances and management gateways like FortiOS and FortiProxy, which are commonly deployed as internet-facing edge services. While the vulnerability requires authenticated administrative access, the appliances themselves frequently present management interfaces that are reachable from the internet in common deployment patterns.

Path Traversal

Fortinet Fortios

6.4.0 to before 7.4.107.6.0 to before 7.6.51.0.0 to before 1.7.17.0.0 to before 7.4.127.0.0 to before 7.0.77.2.0 to before 7.2.8

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in several Fortinet products allows an authenticated administrator to write or delete arbitrary files through command-line interface commands. This could potentially impact the integrity and availability of affected systems. The primary concern for leadership is to confirm if these specific Fortinet products are in use within the organization to assess potential exposure.

Admin users can modify or erase system files.
It affects critical network and management devices.
Confirm product usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative privileges and specific write permissions could exploit this vulnerability by sending specially crafted commands through the command-line interface. This allows them to write or delete files anywhere on the system, potentially leading to system compromise or data manipulation.

Authenticated admin access required.
Specific CLI commands trigger vulnerability.
Arbitrary file write/delete possible.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker with administrative privileges could manipulate system files on affected Fortinet devices. This occurs through specific command-line interface commands when the system's pathnames are improperly limited, potentially allowing for the modification or deletion of arbitrary files.

System files on network devices.
Authenticated attacker executes specific CLI commands.
Arbitrary file write or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Fortinet's FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager products. Due to the nature of these products, infrastructure, platform, and security operations teams are typically responsible for their management and patching. The initial step should be to identify all instances of the affected products, assess their exposure and criticality, and then coordinate with the designated owners to plan remediation.

Infrastructure and security teams own remediation.
Verify product inventory and external exposure.
Plan and apply vendor-provided updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2025-61624?

This vulnerability affects several Fortinet infrastructure management and security tools, specifically FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. These products are widely used by organizations to secure network perimeters, manage privileged access, and monitor switch configurations. Because they sit at the foundation of network operations, they handle sensitive traffic and system-level configurations.

What does Path Traversal mean for CVE-2025-61624?

Path Traversal, classified as CWE-22, occurs when software fails to properly restrict file paths. In this specific case, the vulnerability allows an attacker to navigate outside intended directories. This weakness is significant because it enables a user with sufficient permissions to interact with or delete files anywhere on the system's file structure, which they should normally be unable to access.

How is this vulnerability triggered?

An attacker must already have authenticated administrative access with read-write permissions to the device to trigger this issue. They exploit the flaw by executing specific, specially crafted commands within the product's command-line interface. The vulnerability is not triggered by standard, non-administrative traffic or by simply connecting to the device without these elevated credentials.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies these products as often deployed as internet-facing edge services, such as network gateways or proxies. Because they frequently expose management interfaces to the internet, they are classified as external-facing. If your instance is reachable from the public internet, it carries a higher relevance for remediation compared to instances isolated on internal, private networks.

What steps should I take if I use these products?

Begin by auditing your current infrastructure to identify every instance of the affected Fortinet versions. Since this issue requires administrative access, prioritize reviewing your existing admin accounts and their assigned permissions. Once identified, coordinate with your infrastructure or security teams to verify if your specific version is vulnerable and apply the necessary vendor-provided updates to secure your systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.