CVE-2025-49201
📋 TL;DR
A weak authentication vulnerability in Fortinet FortiPAM and FortiSwitchManager allows attackers to execute unauthorized code or commands via specially crafted HTTP requests. This affects multiple versions of FortiPAM (1.0 through 1.5.0) and FortiSwitchManager (7.2.0 through 7.2.4). Attackers can potentially gain control of affected systems without proper authentication.
💻 Affected Systems
- Fortinet FortiPAM
- Fortinet FortiSwitchManager
📦 What is this software?
Fortipam by Fortinet
Fortipam by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining administrative privileges, executing arbitrary commands, accessing sensitive credentials stored in PAM systems, and pivoting to other network resources.
Likely Case
Unauthorized command execution leading to credential theft, data exfiltration, and installation of backdoors or malware on affected systems.
If Mitigated
Limited impact due to network segmentation, strong authentication controls, and monitoring that detects anomalous HTTP requests.
🎯 Exploit Status
The vulnerability requires specially crafted HTTP requests but does not require authentication, making exploitation relatively straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiPAM 1.5.1 or later, FortiSwitchManager 7.2.5 or later; earlier FortiPAM versions require upgrading to supported versions
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-010
Restart Required: Yes
Instructions:
1. Download the latest firmware from Fortinet support portal. 2. Backup current configuration. 3. Apply firmware update via web interface or CLI. 4. Reboot the appliance. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to FortiPAM and FortiSwitchManager management interfaces to trusted IP addresses only.
config firewall address
edit trusted_ips
set subnet 192.168.1.0 255.255.255.0
next
config firewall policy
edit 1
set srcintf internal
set dstintf mgmt
set srcaddr trusted_ips
set dstaddr all
set action accept
set service HTTP HTTPS
next
edit 2
set srcintf any
set dstintf mgmt
set srcaddr all
set dstaddr all
set service HTTP HTTPS
set action deny
Disable HTTP Management
allDisable HTTP management interface and use HTTPS only with strong authentication.
config system global
set admin-https-redirect enable
set admin-http-port 0
end
🧯 If You Can't Patch
- Implement strict network access controls to limit which systems can communicate with vulnerable appliances.
- Deploy web application firewall (WAF) rules to block suspicious HTTP requests targeting FortiPAM/FortiSwitchManager endpoints.
🔍 How to Verify
Check if Vulnerable:
Check current firmware version via web interface (System > Dashboard) or CLI command: get system statusCheck Version:
get system status | grep VersionVerify Fix Applied:
Verify firmware version is FortiPAM 1.5.1+ or FortiSwitchManager 7.2.5+ and check that no unauthorized HTTP requests are reaching management interfaces.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to FortiPAM/FortiSwitchManager management interfaces
- Multiple failed authentication attempts followed by successful command execution
- Log entries showing command execution from unexpected sources
Network Indicators:
- HTTP traffic to FortiPAM/FortiSwitchManager ports (80, 443) from unauthorized sources
- Unusual outbound connections from Forti appliances
SIEM Query:
source="fortigate" AND (url="*FortiPAM*" OR url="*FortiSwitchManager*") AND (status=200 OR status=302) AND user="-"