Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-864900 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-59718 KEV | CWE-347 Improper Verification of Cryptographic Signature | 9.8 Critical |
CVE-2025-59718 A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message. Mitigation: To prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-6… Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-59719 | CWE-347 Improper Verification of Cryptographic Signature | 9.8 Critical |
CVE-2025-59719 An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message. Mitigation: To prevent being affected by this vulnerability on vulnerable versions, please turn off the FortiCloud login feature (if enabled, disabled by default) temporarily until upgrading to a non-affected version. (see https://fortiguard.fortinet.com/psirt/FG-IR-25-6… Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-53844 | CWE-787 Out-of-bounds Write | 8.8 High |
CVE-2025-53844 A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacker to execute unauthorized code or commands via specially crafted packets. Vendor fix: Update Fortigate NGFW to V7.6.6 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-25249 KEV | CWE-122 Heap-based Buffer Overflow | 8.1 High |
CVE-2025-25249 A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4.0 through 6.4.16, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets Mitigation: For each interface, remove "fabric" access (see https://fortiguard.fortinet.com/psirt/FG-IR-25-084) Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-25253 | CWE-297 Improper Validation of Certificate with Host Mismatch | 7.5 High |
CVE-2025-25253 An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow an unauthenticated attacker in a man-in-the middle position to intercept and tamper with connections to the ZTNA proxy Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-53843 | CWE-121 Stack-based Buffer Overflow | 7.5 High |
CVE-2025-53843 A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets Mitigation: Disable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs (see https://fortiguard.fortinet.com/psirt/FG-IR-25-358 for more information) Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-57740 | CWE-122 Heap-based Buffer Overflow | 7.5 High |
CVE-2025-57740 An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions; FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions RDP bookmark connection may allow an authenticated user to execute unauthorized code via crafted requests. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-58413 | CWE-121 Stack-based Buffer Overflow | 7.5 High |
CVE-2025-58413 A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiSASE 25.3.b allows attacker to execute unauthorized code or commands via specially crafted packets Mitigation: Disable security fabric access into interface. Only allow legit devices in Wifi Controller > Managed FortiAPs. Remove inter-controller-peer elements in config wireless-controller inter-controller configuration. (see https://fortiguard.fortinet.com/psirt/FG… Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-53744 | CWE-266 Incorrect Privilege Assignment | 7.2 High |
CVE-2025-53744 An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-22862 | CWE-288 Authentication Bypass Using an Alternate Path or Channel | 6.7 Medium |
CVE-2025-22862 An Authentication Bypass Using an Alternate Path or Channel vulnerability in FortiOS and FortiProxy may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-24471 | CWE-295 Improper Certificate Validation | 6.5 Medium |
CVE-2025-24471 An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to connect from FortiClient via revoked certificate. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2024-55599 | CWE-358 Improperly Implemented Security Check for Standard | 5.3 Medium |
CVE-2024-55599 An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.4 all versions and FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions may allow a remote unauthenticated user to bypass the DNS filter via Apple devices. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-25248 | CWE-190 Integer Overflow or Wraparound | 5.3 Medium |
CVE-2025-25248 An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2024-50562 | CWE-613 Insufficient Session Expiration | 4.8 Medium |
CVE-2024-50562 An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-31366 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 4.7 Medium |
CVE-2025-31366 An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] in FortiOS 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4.0 through 7.4.9, 7.2 all versions, 7.0 all versions; FortiSASE 25.3.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-25250 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor | 4.3 Medium |
CVE-2025-25250 An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in FortiOS version 7.6.0, version 7.4.7 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions SSL-VPN web-mode may allow an authenticated user to access full SSL-VPN settings via crafted URL. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2024-52963 | CWE-787 Out-of-bounds Write | 3.7 Low |
CVE-2024-52963 A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets. Mitigation: Under the config vpn ipsec phase1-interface configuration, either set authmethod to psk, or set digital-signature-auth to disable (see https://fortiguard.fortinet.com/psirt/FG-IR-24-373) Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-31514 | CWE-532 Insertion of Sensitive Information into Log File | 2.7 Low |
CVE-2025-31514 An Insertion of Sensitive Information into Log File vulnerability [CWE-532] in FortiOS 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an attacker with at least read-only privileges to retrieve sensitive 2FA-related information via observing logs or via diagnose command. Vendor fix: Update Fortigate NGFW to V7.6.6 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-58903 | CWE-252 Unchecked Return Value | 2.7 Low |
CVE-2025-58903 An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-47890 | CWE-601 URL Redirection to Untrusted Site ('Open Redirect') | 2.6 Low |
CVE-2025-47890 An URL Redirection to Untrusted Site vulnerabilities [CWE-601] in FortiOS 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiProxy 7.6.0 through 7.6.3, 7.4 all versions, 7.2 all versions, 7.0 all versions; FortiSASE 25.2.a may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2024-32122 | CWE-522 Insufficiently Protected Credentials | 2.3 Low |
CVE-2024-32122 An insufficiently protected credentials vulnerability in FortiOS may allow a privileged authenticated attacker to retrieve LDAP credentials via modifying the LDAP server IP address in the FortiOS configuration to point to a malicious attacker-controlled server. Vendor fix: Update Fortigate NGFW to V7.4.9 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
| CVE-2025-54821 | CWE-269 Improper Privilege Management | 1.9 Low |
CVE-2025-54821 An Improper Privilege Management vulnerability [CWE-269] in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.6.0, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow an authenticated administrator to bypass the trusted host policy via crafted CLI command. Vendor fix: Update Fortigate NGFW to V7.6.6 or later following the secure update recommendation procedure. Contact customer support to receive detailed information Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-59718 | 9.1 Critical | Fortinet Multiple Products Fortinet FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb contain an improper verification of cryptographic signature vulnerability that may allo… |
| CVE-2025-59719 | 9.1 Critical | Fortinet FortiWeb An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.… |
| CVE-2025-53844 | 8.3 High | Fortinet FortiOS A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11 allows attacke… |
| CVE-2025-25249 | 7.4 High | Fortinet Multiple Products Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorize… |
| CVE-2025-53843 | 6.9 Medium | Fortinet FortiOS A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7… |
| CVE-2025-58413 | 6.9 Medium | Fortinet FortiOS A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7… |
| CVE-2025-25253 | 6.8 Medium | Fortinet FortiProxy An Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 … |
| CVE-2025-53744 | 6.8 Medium | Fortinet FortiOS An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versio… |
| CVE-2025-57740 | 6.7 Medium | Fortinet FortiPAM An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.0 all … |
| CVE-2025-22862 | 6.3 Medium | Fortinet FortiProxy An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and a… |
| CVE-2025-24471 | 6.0 Medium | Fortinet FortiOS An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remo… |
| CVE-2024-55599 | 4.9 Medium | Fortinet FortiOS An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS version 7.6.0, version 7.4.7 and below, 7.0 all versions, 6.… |
| CVE-2025-25248 | 4.8 Medium | Fortinet FortiOS An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 … |
| CVE-2025-31366 | 4.5 Medium | Fortinet FortiSASE An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS … |
| CVE-2024-50562 | 4.4 Medium | Fortinet FortiOS An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 a… |
| CVE-2025-25250 | 3.9 Low | Fortinet FortiOS An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through … |
| CVE-2024-52963 | 3.5 Low | Fortinet FortiProxy A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allow… |
| CVE-2025-31514 | 2.6 Low | Fortinet FortiOS A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all v… |
| CVE-2025-47890 | 2.5 Low | Fortinet FortiOS An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, Fo… |
| CVE-2025-58903 | 2.5 Low | Fortinet FortiOS An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user t… |
| CVE-2024-32122 | 2.1 Low | Fortinet FortiOS A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 … |
| CVE-2025-54821 | 1.7 Low | Fortinet FortiOS An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.