Target Industry
Indiscriminate, opportunistic targeting.
Overview
The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities Catalogue (KEV), which are under active exploitation. These vulnerabilities are tracked as CVE-2025-24472 and CVE-2025-30066.
Impact
CVE-2025-24472 is a critical vulnerability and has a CVSS score of 9.8. It is a vulnerability in FortiOS and FortiProxy, which is an authentication bypass issue. It could enable the threat actor to take full control of the affected systems.
CVE-2025-30066 is a high severity vulnerability and has a CVSS score of 8.6. It is a vulnerability in GitHub Action within the tj-actions/changed-files. It could inadvertently leak confidential data due to the malicious modifications.
Affected Products
CVE-2025-24472:
- FortiOS: Versions 7.0.0 through 7.0.162
- FortiProxy: Versions 7.0.0 through 7.0.19 and 7.2.0-7.2.123.
CVE-2025-30066:
- tj-actions/changed-files GitHub Action versions from v1-v45.0.71.
Exploitation
CVE-2025-24472 allows a remote threat actor to gain super-admin privileges via crafted CSF proxy requests. By exploiting this vulnerability, threat actors can bypass the normal authentication mechanisms and gain full control over the affected systems, potentially leading to unauthorised access and manipulation of sensitive data. Recently, LockBit has exploited it in their ransomware campaign.
CVE-2025-30066 is a supply chain attack vulnerability. It allows a remote threat actor to discover secrets by reading action logs. The tags from v1 through to v45.0.7 were compromised by a threat actor who modified them to point at a malicious commit containing code that could expose sensitive information. This could lead to the leakage of confidential data such as API keys and tokens.
Containment, Mitigations & Remediations
It is highly recommended to update the affected products to the latest version to mitigate against CVE-2025-24472. As well as:
- Network Segmentation: Implement network segmentation to limit the impact of any potential breach
- Enhanced Monitoring: Use advanced monitoring tools to detect and respond to suspicious activities
- Audit Logs: Regularly audit logs for any anomalies or signs of exploitation.
For CVE-2025-30066 the following steps are advised:
- Update or Remove the Action: Replace or update the tj-actions/changed-files action to a verified, non-malicious version as recommended by the maintainers
- Check Logs: Review action logs for any signs of compromised secrets and take appropriate measures to secure them
- Runtime Monitoring: Use tools like Sysdig Secure and Falco to detect memory scanning activities and other suspicious behaviours
- Security Hardening: Follow security hardening guides for GitHub Actions to prevent similar supply chain attacks.
Threat Landscape
On a global scale, both vendors of these vulnerabilities are utilised by over 40,000 companies. These vulnerabilities underscore the critical need to keep systems updated with the latest software versions and to monitor logs for any suspicious activity.
Further Information
