CVE-2025-61624 explained: the Fortinet Fortios flaw and how to fix it

The two-minute check

1. Open the administrator login page for your firewall, proxy, or switch management device.
2. Check whether the login screen or dashboard names FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager.
3. Note the version number shown under "System Information" or "Firmware Version" on that screen.
4. If you operate a Siemens RUGGEDCOM APE1808 device, check the label on the hardware or its management console for the model name.

When you can stop reading

If your business does not run FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager, this flaw does not apply to you. The same is true if you do not operate a Siemens RUGGEDCOM APE1808 device or its firmware. You can close this tab.

What the official record says

The National Vulnerability Database (NVD) scores this flaw using the Common Vulnerability Scoring System (CVSS) at 6.5, rated MEDIUM (NVD). The scoring details explain who can reach it and how. An attacker needs network access and an existing admin-level account with read-write permissions already in place. No user interaction, like clicking a link, is required. If exploited, the attacker can write or delete files on the device, which affects the system's integrity and availability rather than exposing stored data.

The Exploit Prediction Scoring System (EPSS) puts the chance of exploitation in the next 30 days at 0.58%, landing at the 46.551 percentile among all scored flaws (FIRST.org). That is a low chance of exploitation in the next 30 days. EPSS forecasts near-term attack activity. It does not measure how severe the flaw itself is.

This flaw is also listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (CISA KEV catalog). That listing means confirmed exploitation has already happened somewhere, separate from the EPSS forecast above. The record does not note any known ransomware use tied to this flaw.

What that means for a business like yours

An attacker already needs an admin-level login with read-write access to use this flaw. A random outsider cannot exploit it with a simple login guess. The real risk comes from an insider, a stolen admin password, or an attacker who already gained partial access some other way. Once inside, they could write or delete files on the device, which can disrupt the firewall or proxy protecting your network.

If someone else manages your IT

If LayerLogix or another provider manages your firewall, send a short note today. You can copy the lines below.

"Please check our FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager devices against CVE-2025-61624. Please apply the vendor's fix from the FortiGuard advisory. Please confirm once it is done."

If you manage it yourself

1. Log in to your FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager administrator console.
2. Open the FortiGuard advisory for this flaw in a new tab (FortiGuard PSIRT advisory).
3. Compare your current version against the versions listed in the advisory.
4. If you operate a Siemens RUGGEDCOM APE1808 device, check the Siemens advisory instead (Siemens ProductCERT advisory).
5. Follow the vendor's instructions to apply the fix. The record does not name a specific fixed version, so check the advisory for the current build.
6. Restrict admin accounts so only the people who truly need read-write access keep it.
7. Review admin activity logs for any CLI commands you do not recognize.

This flaw is on the CISA Known Exploited Vulnerabilities (KEV) catalog, which means criminals are already using it (CISA KEV catalog). Federal agencies must fix it by 2026-10-19. Your business is not bound by that federal deadline. It is still a reasonable target date for your own patch.

After applying the vendor's fix, log back in to the administrator console. Check the firmware or version number again. Confirm it no longer matches the vulnerable versions listed in the FortiGuard advisory (FortiGuard PSIRT advisory). Review the admin accounts with read-write access once more, since the fix does not change who already had permissions. If you operate a Siemens RUGGEDCOM APE1808 device, confirm its version against the Siemens advisory as well (Siemens ProductCERT advisory).

If you cannot patch today, limit admin-level accounts to the smallest number of people possible. This does not fix the flaw. It reduces who could misuse it.

Turn on logging for CLI commands and review it daily until the fix is applied. Logging will not stop an attack. It will help you notice one quickly.

Consider a privileged access management approach so fewer accounts carry read-write rights. This narrows the path an attacker would need. It does not close that path completely.

If your business handles protected health data or falls under HIPAA or the FTC Safeguards Rule, document these interim steps. Reviewers expect to see what you did while waiting to patch.

Do I have to do anything if we only use FortiOS for a small office network?

Yes. Size does not change whether this flaw applies to your device. If you run FortiOS, check the version shown on your console and apply the vendor's fix regardless of how many people use your network.

Will applying this fix break anything?

The record does not say whether the fix changes other features. Read the FortiGuard advisory before you apply it, since vendor advisories usually note any side effects. If you are unsure, our managed IT services team can test the update first.

What if we don't know which version we're running?

Log in to the administrator console and look for System Information or Firmware Version on the dashboard. If you cannot find it, contact whoever set up the device. You can also request a free IT assessment and we will check for you.

Does this affect our regular office computers?

No. This flaw is specific to FortiOS, FortiPAM, FortiProxy, FortiSwitchManager, and the Siemens RUGGEDCOM APE1808 device and firmware. It does not involve general office computers or phones.

We think an attacker may have already used this against us. What now?

Contact your IT provider immediately. If you work with LayerLogix, use our contact page for business-hours support with after-hours emergency response. With 20+ years of experience and 100% Texas-based support, we can help you confirm what happened and get the fix applied.

If you want a second set of eyes on your Fortinet devices, request a free IT assessment or contact LayerLogix today.