The short version
On October 16, 2026, CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities (KEV) catalog, which means there’s evidence attackers are using it. The flaw is a path traversal vulnerability in the operating system of a widely used line of business firewalls, along with related proxy, privileged-access and switch-management products. These firewalls are common in small and midsized offices, so check whether your firewall’s make and firmware appear in the vendor advisory linked from the NVD entry for CVE-2025-61624.
What the vulnerability does
According to CISA, the flaw “may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.” In plain terms, an attacker who already has an administrator login can tamper with files on the device.
Why it matters even though it needs an admin login
It’s tempting to dismiss a bug that needs admin credentials. Don’t. Firewall admin credentials get stolen, reused or left at defaults, and attackers chain flaws together. Earlier this year CISA also listed CVE-2025-68686 (added July 27, 2026), an issue in the same firewall operating system that can let an attacker bypass the vendor’s fix for a symbolic-link persistence mechanism “observed in some post-exploit cases.” That’s a reminder that attackers who reach a firewall work to stay there.
Affected and fixed versions
The vendor rates the flaw Medium (CVSSv3 6.0) and marks it as known exploited. Recent releases on the two current firmware branches are affected and have fixed releases available; every release on the older branches is affected and has no patch, so devices on those branches have to move to a fixed release on a current branch. Your IT provider can match your exact model and firmware against the vendor advisory linked from the NVD entry.
What to do now
- Identify every firewall, web proxy and switch-management appliance you own and its firmware version.
- Compare it with the vendor advisory and upgrade to a fixed release.
- Make sure management interfaces (HTTPS/SSH admin) aren’t exposed to the internet; restrict them to trusted IPs.
- Review admin accounts: remove unused ones, use unique strong passwords and MFA where supported.
- Check logs for unexpected admin logins or configuration changes. If you find any, treat it as an incident.
- Confirm configuration backups exist so you can rebuild a clean device if needed.
How Queen City IT Professionals can help
If you’re not sure what firewall you have, what version it runs or who has admin access, start with a free IT & security assessment. Learn more on our cybersecurity page and our managed IT page.
Frequently asked questions
What is CVE-2025-61624?
A path traversal vulnerability in a widely used business firewall operating system and related products that may let an authenticated attacker with read-write admin permissions write or delete arbitrary files through specific CLI commands. CISA added it to the KEV catalog on October 16, 2026.
How do I know if my firewall is affected?
Check your firewall’s make, model and firmware version against the vendor advisory linked from the NVD entry for CVE-2025-61624. Devices on older firmware branches have no patch on that branch and need to move to a fixed release.
Is my firewall safe if no one outside has the admin password?
It’s lower risk, but admin credentials are often stolen or reused, and attackers chain vulnerabilities. Patch it anyway, and restrict admin access to trusted networks.
How do I find out what firmware my firewall runs?
An administrator can see the version on the device dashboard. If you don’t have admin access or don’t know who does, that’s a finding in itself.