This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes 4 vulnerabilities

Fortinet fixes 4 vulnerabilities in its products, with vulnerability CVE-2025-25257 having been added to CISA's Known Exploited Vulnerabilities catalog [1]. Products and their fixes: FortiWeb - 7.6.4, 7.4.8, 7.2.11, 7.0.11 [2] FortiSandbox - 4.4.5, 4.2.7 [3] FortiIsolator - 2.4.5 [3][4] Forti OS - 7.6.3, 7.4.8, 7.2.12 [5]

Fortinet FortiWeb - SQL injection (CVE-2025-25257)
CVSS 9.8 (Critical)

An unauthenticated remote attacker is, due to improper neutralization of special elements used in an SQL command in FortiWeb, allowed to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests [2].

The vulnerability is present in product:

  • FortiWeb; >=7.6.0, <=7.6.3; >=7.4.0, <=7.4.7; >=7.2.0, <=7.2.10; >=7.0.0, <=7.0.10

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C

More information:

  • CVE-2025-25257 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 17. 7. 2025.

Fortinet FortiSandbox, FortiIsolator - improper access control (CVE-2024-27779)
CVSS 6.7 (Medium)

An authenticated remote attacker is, due to insufficient session termination in FortiSandbox and FortiIsolator, allowed to keep using a session with administrator privileges even after the respective user has been deleted, provided they hold a valid session cookie with administrator privileges [3].

The vulnerability is present in products:

  • FortiIsolator; >=2.4.0, <=2.4.4; =2.3; =2.2; =2.1; =2.0; =1.2
  • FortiSandbox; >=4.4.0, <=4.4.4; >=4.2.0, <=4.2.6; =4.0; =3.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 18. 7. 2025.

Fortinet FortiIsolator - access control bypass (CVE-2024-32124)
CVSS 4.3 (Medium)

An authenticated remote attacker with read-only privileges is, due to improper access control in the logging component of FortiIsolator, allowed to modify logs via a specially crafted HTTP request [4].

The vulnerability is present in product:

  • FortiIsolator; >=2.4.3, <=2.4.4; =2.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:X/RC:X

More information:

The vulnerability was publicly disclosed 18. 7. 2025.

Fortinet Forti OS - arbitrary code execution (CVE-2025-24477)
CVSS 4.2 (Medium)

An authenticated local attacker is, due to a heap-based buffer overflow vulnerability in the cw_stad daemon in FortiOS, allowed to execute arbitrary code or commands via specially crafted requests [5].

The vulnerability is present in product:

  • FortiOS; >=7.6.0, <=7.6.2; >=7.4.0, <=7.4.7; >=7.2.4, <=7.2.11

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 18. 7. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 24. 7. 2025.

CESNET, z.s.p.o. Logo