Path Traversal in Fortinet FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager (CVE‑2025‑61624) Enables Authenticated Admin to Write or Delete Arbitrary Files
What It Is — Fortinet disclosed a path‑traversal flaw (CVE‑2025‑61624) affecting FortiOS, FortiPAM, FortiProxy and FortiSwitchManager. An attacker who already holds an admin account with read‑write privileges can issue crafted CLI commands to write to or delete any file on the device’s filesystem.
Exploitability — The vulnerability requires a valid privileged account; no public exploit or ransomware‑as‑a‑service has been observed. The CVSS score is rated 7.8 (High), reflecting the impact of arbitrary file manipulation on confidentiality, integrity and availability.
Affected Products — FortiOS, FortiPAM, FortiProxy, FortiSwitchManager (all current and supported releases).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of over‑privileged accounts – a core access‑control objective that underpins many frameworks (e.g., NIST CSF 2.0).
- Continuous monitoring of privileged‑account activity and file‑system changes provides the audit evidence enterprises need to prove due diligence.
- A breach stemming from this flaw would erode the defensible trust posture that customers demand during security reviews.
Recommended Actions
- Apply Fortinet’s patch immediately; verify version numbers against the advisory.
- Conduct a privileged‑access review – enforce least‑privilege, separate duties, and enable MFA for admin accounts.
- Deploy file‑integrity monitoring and log aggregation to capture any unauthorized file writes or deletions.
- Update your security policies to require documented evidence of privileged‑access controls for audit readiness.
Source: CISA KEV – CVE‑2025‑61624