CVE-2025-55018
CVSS 5.8 MEDIUM: an inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0… EPSS 0.4% (32º percentile).
Vulnerabilità ed exploit
Siemens ProductCERT segnala due vulnerabilità in FortiOS: CVE-2025-55018 e CVE-2025-62439. CVE-2025-55018 permette HTTP request smuggling che può eludere il logging del firewall. CVE-2025-62439 permette a utenti autenticati con conoscenza FSSO accesso non autorizzato a risorse protette.
1 fonte · 10 mar
CVSS 5.8 MEDIUM: an inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0… EPSS 0.4% (32º percentile).
CVSS 4.2 MEDIUM: an Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet… EPSS 0.2% (4º percentile).
Siemens ProductCERT
SSA-027652
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms.
originaleSiemens ProductCERT
SSA-770770
Siemens has identified the following specific mitigations that customers can apply to reduce the risk: Product-specific remediations or mitigations can be found in the section Known Affected Products.
originaleSiemens ProductCERT
SSA-975644
originalePart of the PlainSec briefing for 2026-03-10
Every edition of this story: FortiOS permette bypass dei log e accesso a reti protette