SB2025061112 - Improper restriction of communication channel to intended endpoints in FortiOS 



SB2025061112 - Improper restriction of communication channel to intended endpoints in FortiOS

Published: June 11, 2025

Security Bulletin ID SB2025061112
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper restriction of communication channel to intended endpoints (CVE-ID: CVE-2025-22251)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper restriction of communication channel to intended endpoints in FGSP. An unauthenticated attacker can inject unauthorized sessions via crafted FGSP session synchronization packets.


Remediation

Install update from vendor's website.