Security News
긴급도 79/100 심각도 6 · 보통 악용확률 64.8% CISA KEV · 2026-10-16 CWE-22

CVE-2025-61624

CISA 기관 조치 기한: 2026-10-19

Fortinet Multiple Products

Qualys 위협 인텔 · 심각도 3/5 · QID 44982 · Hardware
측면이동 권한상승
  • CVSS Temporal 5.9 (현재 위협 반영)
  • 익스플로잇 성숙도: PoC (2/4)
  • 공격 위치: 원격
  • 패치: 가능
  • PCI-DSS 관련
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.7.0, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSwitchManager 7.2.0 through 7.2.7, FortiSwitchManager 7.0.0 through 7.0.6 may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
KEV 필수 조치: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
타임라인
  1. NVD 공개
  2. 첫 보도 Unit 42 · Unit 42, 은밀한 FortiGate 임플란트인 ‘PEERSTITCH’를 밝혀내다
  3. CISA KEV 등재(실제 악용 확인) 공개 후 185일
  4. 최근 보도 (총 5건) The Hacker News · ⚡ 주간 요약: 제로데이 취약점 98건, 악성 AI 에이전트, 1억 …
  5. CISA 기관 조치 기한 경과

벡터: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

NVD 상세 ↗   GitHub Advisory ↗   벤더 권고문 ↗   참고 링크 ↗

이 취약점을 다룬 기사 (5)

← 취약점 목록