This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes 9 vulnerabilities

Fortinet fixes 9 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found in the individual links. Products and their fixed versions: FortiADC - 7.2.1, 7.1.2 [1] FortiOS - 7.6.3, 7.4.8 [2][3] FortiPAM - 1.7, 1.6, 1.5.1, 1.4.3 [3] FortiProxy - 7.6.3, 7.4.4 [3] FortiSIEM - 7.3.2, 7.2.6, 7.1.8, 7.0.4, 6.7.10 [4] FortiSOAR - 7.6.2, 7.5.2 [5] FortiWeb - 7.6.4, 7.4.9, 7.2.11, 7.0.11 [6][7][8][9]

FortiSIEM - RCE, OS command injection (CVE-2025-25256)
CVSS 9.8 (Critical)

An unauthenticated remote attacker, due to insufficient input sanitization in the FortiSIEM CLI, is able to execute code or arbitrary commands in the operating system of the vulnerable device. According to Fortinet, a working exploit for this vulnerability is already available [4][10].

The vulnerability is present in product:

  • FortiSIEM; >=5.4.0, <=5.4.3; >=6.1, <=6.7.9; >=7.0.0, <=7.0.3; >=7.1.0, <=7.1.7; >=7.2.0, <=7.2.5; >=7.3.0, <=7.3.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-25256 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 8. 2025.

FortiWeb - authentication bypass (CVE-2025-52970)
CVSS 8.1 (High)

An unauthenticated remote attacker with knowledge of non-public information about the target device and user, due to improper parameter handling in FortiWeb, is able to log in to the vulnerable instance as the given user (including an administrator) by means of a specially crafted request [8][11].

The vulnerability is present in product:

  • FortiWeb; >=7.0.0, <=7.0.10; >=7.2.0, <=7.2.10; >=7.4.0, <=7.4.7; >=7.6.0, <=7.6.3;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 8. 2025.

FortiOS - privilege escalation (CVE-2025-53744)
CVSS 7.2 (High)

An authenticated remote attacker with elevated privileges, by registering a device running a vulnerable version of FortiOS to a malicious FortiManager, is able to escalate their privileges up to the super-admin level [2].

The vulnerability is present in product:

  • FortiOS; >=6.4, <=6.4.16; >=7.0, <=7.0.17; >=7.2, <=7.2.11; >=7.4.0, <=7.4.7; >=7.6.0, <=7.6.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 12. 8. 2025.

FortiADC - RCE, OS command injection (CVE-2025-49813)
CVSS 7.2 (High)

An authenticated remote attacker, due to insufficient input sanitization in FortiADC, is able to execute code or arbitrary commands in the operating system of the vulnerable device by means of a specially crafted HTTP request [1].

The vulnerability is present in product:

  • FortiADC; >=6.2, <=6.2.6; >=7.1.0, <=7.1.1; ==7.2.0;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-49813 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 12. 8. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 18. 8. 2025.

CESNET, z.s.p.o. Logo