Introduction
When certificate validation is implemented badly, attackers can intercept and tamper with encrypted enterprise traffic. CVE-2025-25253 is a certificate host mismatch flaw that exposes FortiProxy and FortiOS ZTNA proxy deployments to man-in-the-middle attacks, which may undermine the security of remote access in production environments.
Fortinet is a major global vendor of network security appliances, including FortiProxy and FortiOS, with a large presence in enterprise and service provider networks. Its ZTNA (Zero Trust Network Access) products are widely adopted for secure remote access and application segmentation. Fortinet products are known for their breadth of features and are deployed in thousands of organizations worldwide.
Technical Information
CVE-2025-25253 is an improper validation of certificate with host mismatch vulnerability, classified as CWE-297. The flaw is in the ZTNA proxy component of both FortiProxy and FortiOS. When a client connects to the ZTNA proxy, the software does not properly check that the certificate the server presents matches the expected hostname for the connection. An attacker positioned as a man in the middle can present a valid certificate for a different host, and the proxy accepts it. The attacker can then intercept, and potentially modify, encrypted traffic between the client and the ZTNA proxy.
The vulnerability is limited to the ZTNA proxy functionality. No public code snippets or proof-of-concept details are available. The root cause is a failure to enforce strict hostname verification during certificate validation, which is a critical requirement for secure TLS communication. Flaws of this type are well documented in the security community, and they can seriously compromise the confidentiality and integrity of network traffic.
Affected Systems and Versions
- FortiProxy version 7.6.1 and below
- FortiProxy version 7.4.8 and below
- FortiProxy 7.2 all versions
- FortiProxy 7.0 all versions
- FortiOS version 7.6.2 and below
- FortiOS version 7.4.8 and below
- FortiOS 7.2 all versions
- FortiOS 7.0 all versions
Only the ZTNA proxy component is affected. Every configuration that uses ZTNA proxy on the versions above is vulnerable.
Vendor Security History
Fortinet has had several certificate validation and authentication vulnerabilities in its product lines, particularly in VPN and ZTNA features. Notable past issues include improper certificate validation and authentication bypasses in FortiOS and FortiProxy. The company runs a dedicated Product Security Incident Response Team (PSIRT) and generally responds quickly to reported vulnerabilities with advisories and patches. Some high- and critical-severity vulnerabilities in Fortinet products have been exploited in the wild, so prompt patching matters.
