cve-2025-25252

MEDIUM CVSS 4.8 nvd
Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

Timeline
Published
2025-10-14
Last Modified
2026-10-08
CVSS Details
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
Affected Products
  • fortinet fortios
Weaknesses (CWE)
CWE-613
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 4.8 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N 2.2 2.5 psirt@fortinet.com
3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 3.9 2.5 nvd@nist.gov
CPE configurations
OR
CPE Version range Vulnerable
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* >= 6.4.0, < 7.0.17 yes
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* >= 7.2.0, < 7.2.11 yes
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* >= 7.4.0, < 7.4.7 yes
cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* >= 7.6.0, < 7.6.3 yes
NVD metadata
NVD status
Analyzed
Source identifier
psirt@fortinet.com
References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cvss": 4.8,
  "datePublished": "2025-10-14T16:15:36.683",
  "dateUpdated": "2026-10-08T12:10:00.217",
  "description": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.",
  "id": "CVE-2025-25252",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "cpes": [
              "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.16:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
              "cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "FortiOS",
            "vendor": "Fortinet",
            "versions": [
              {
                "lessThanOrEqual": "7.6.2",
                "status": "affected",
                "version": "7.6.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.4.6",
                "status": "affected",
                "version": "7.4.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.10",
                "status": "affected",
                "version": "7.2.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.16",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.4.16",
                "status": "affected",
                "version": "6.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@fortinet.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "71B60D86-1681-44AC-A5C5-3776BD07040B",
                "versionEndExcluding": "7.0.17",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "4386465B-EFF9-41BA-B393-82135A2591DE",
                "versionEndExcluding": "7.2.11",
                "versionStartIncluding": "7.2.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "DE7A88C9-8466-4414-AECB-0689F23108CD",
                "versionEndExcluding": "7.4.7",
                "versionStartIncluding": "7.4.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "D6B883B9-9ECD-4BC5-B497-770F34F92473",
                "versionEndExcluding": "7.6.3",
                "versionStartIncluding": "7.6.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record."
      },
      {
        "lang": "es",
        "value": "Una vulnerabilidad de expiración de sesión insuficiente [CWE-613] en FortiOS SSL VPN 7.6.0 a 7.6.2, 7.4.0 a 7.4.6, 7.2.0 a 7.2.10, 7.0.0 a 7.0.16, 6.4 todas las versiones puede permitir a un atacante remoto (p. ej., un exadministrador cuya cuenta fue eliminada y cuya sesión fue terminada) en posesión del registro SAML de una sesión de usuario acceder o reabrir esa sesión mediante la reutilización del registro SAML."
      }
    ],
    "id": "CVE-2025-25252",
    "lastModified": "2026-10-08T12:10:00.217",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.2,
          "impactScore": 2.5,
          "source": "psirt@fortinet.com",
          "type": "Secondary"
        },
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-25252",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-12T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-14T16:15:36.683",
    "references": [
      {
        "source": "psirt@fortinet.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-487"
      }
    ],
    "sourceIdentifier": "psirt@fortinet.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-613"
          }
        ],
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "MEDIUM",
  "source": "nvd",
  "title": "An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4...."
}
View JSON API Download JSON