CVE-2025-25256

CRITICAL9.8

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7

Published Aug 12, 2025

Modified 5 months ago

Details

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

References

ADVISORYhttps://fortiguard.fortinet.com/psirt/FG-IR-25-152 DETECTIONhttps://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256 WEBhttps://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-25256 WEBhttps://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/

Aliases

FG-IR-25-152

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:X/RC:C

Weakness Type (CWE)

Injection

CWE-78

OS Command Injection

Ecosystems

Timeline

PublishedAug 12, 2025

ModifiedAug 16, 2025