FortiOS and FortiSwitchManager: admin-level CLI path traversal writes or deletes arbitrary files on the appliance

CVSS 6.5CVE-2025-61624Firmware, BMC & network fabricKnown exploitedcurated

Impact

Specific CLI commands do not constrain pathnames, so an administrator with read-write permissions can write or delete arbitrary files on the appliance instead of only the files the command is meant to touch. On FortiSwitchManager and FortiPAM this reaches the systems that manage switching fabric and hold privileged credentials, which is why it matters beyond the box itself: the appliance is trusted by the network and secrets layers around it. The flaw needs an admin profile already, so it is a privilege-consolidation and persistence tool rather than an entry point - an operator or compromised admin session turns configured access into arbitrary filesystem control, including destroying files needed for boot or audit. CISA lists this CVE as known-exploited, so assume it is being chained after credential theft or an earlier appliance bug.

Who can reach it

Network access to the appliance's CLI as an authenticated administrator holding a profile with at least read-write permissions. Not reachable by an unprivileged user or a tenant workload; the realistic path is stolen or shared admin credentials.

What to do

Upgrade to the fixed releases listed in Fortinet FG-IR-26-122 for each affected product line - FortiOS 7.6 and 7.4 have fixed builds, while FortiOS 7.2, 7.0 and 6.4, FortiProxy 7.2 and 7.0, and the older FortiPAM branches are listed as affected in all versions, which means migrating to a supported branch rather than patching in place. Siemens RUGGEDCOM APE1808 ships FortiOS and is tracked separately in SSA-975644. Cost is an appliance firmware upgrade and reboot with a traffic failover window; where an upgrade cannot be scheduled, cut the number of accounts holding read-write admin profiles and audit CLI access logs.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-61624 https://fortiguard.fortinet.com/psirt/FG-IR-26-122 https://cert-portal.siemens.com/productcert/html/ssa-975644.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61624

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.