CVE Database · CVE-2025-22251
CVSS v3.1
3.1
EPSS
0.34%
Published
Jun 10, 2025
Modified
Jul 25, 2025
Public PoC / Exploit
All weaponized →No public PoC or exploit code indexed for this CVE.
Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.
CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NWeaknesses (CWE)
References (1)