CVE-2024-52965 in FortiOS
Summary
by MITRE • 07/08/2025
A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/23/2025
This vulnerability represents a critical flaw in the authentication process of Fortinet FortiOS and FortiProxy products that directly violates fundamental security principles. The issue manifests as a missing critical step in authentication where the system fails to properly validate the certificate used for PKI-based authentication. This weakness exists across multiple versions of both FortiOS and FortiProxy, creating a widespread exposure that affects organizations relying on these security appliances. The vulnerability is classified as CWE-304, which specifically addresses "Missing Critical Step in Authentication" and represents a significant deviation from proper authentication protocols that should validate all components of multi-factor authentication mechanisms.
The technical flaw occurs when an API user attempts to authenticate using both an api-key and a PKI user certificate. Under normal circumstances, the system should validate that the certificate is not only present but also valid, properly signed, and within its designated validity period. However, this vulnerability allows authentication to proceed successfully even when the certificate is invalid, revoked, or otherwise compromised. The system essentially bypasses certificate validation checks that should occur during the authentication process, creating a path for unauthorized access that undermines the entire PKI-based authentication framework. This weakness enables attackers to leverage compromised or invalid certificates to gain system access, potentially leading to complete system compromise.
The operational impact of this vulnerability is severe and multifaceted, as it fundamentally compromises the security posture of affected organizations. An attacker who can exploit this vulnerability gains unauthorized access to administrative functions through the API interface, potentially leading to complete system compromise and data breaches. The vulnerability affects both FortiOS and FortiProxy appliances, which are commonly deployed in enterprise environments for network security and application delivery. Organizations using these appliances may experience unauthorized access to critical network infrastructure, with potential implications for network monitoring, access control, and application security. The impact extends beyond simple unauthorized access to include potential privilege escalation and lateral movement within the network, as the compromised authentication mechanism could be leveraged to access additional systems and resources.
Organizations should prioritize immediate remediation efforts by updating their FortiOS and FortiProxy appliances to the latest available versions that contain patches for this vulnerability. The vulnerability affects multiple version ranges, requiring careful inventory management to identify all affected systems. Security teams should implement additional monitoring for unauthorized API access attempts and certificate validation failures. Network segmentation and least privilege principles should be reinforced to limit the potential impact of successful exploitation. The vulnerability aligns with ATT&CK technique T1078 which covers legitimate credentials, and T1566 which involves social engineering through credential compromise. Organizations should also consider implementing certificate monitoring solutions to detect and alert on invalid certificate usage, and establish more robust certificate lifecycle management processes to prevent similar issues in the future.