CVE-2025-25256

Published Aug 12, 2025

Last updated 5 months ago

Fortinet

FortiSIEM

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-25256 is an OS command injection vulnerability affecting Fortinet FortiSIEM versions 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9. The vulnerability stems from improper neutralization of special elements within command-line interface (CLI) requests. This vulnerability allows an unauthenticated attacker to execute unauthorized code or commands on vulnerable devices by sending specially crafted CLI requests. Exploit code has been found in the wild, and successful exploitation may not produce distinctive indicators of compromise (IoCs), making it difficult to detect.

Description: An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
Source: psirt@fortinet.com
NVD status: Modified
Products: fortisiem

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@fortinet.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AE219A7C-15F6-42F1-8A2E-2D9C2D182F47",
            "versionEndExcluding": "6.7.10",
            "versionStartIncluding": "5.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C19909A4-227B-460D-B1EF-5115B8DB0CF9",
            "versionEndExcluding": "7.0.4",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "119827CE-B8BF-4418-830F-B87CA0305265",
            "versionEndExcluding": "7.1.8",
            "versionStartIncluding": "7.1.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8DBF861B-B200-40BA-86A3-51E90F3DCF04",
            "versionEndExcluding": "7.2.6",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0A631305-1FA5-4CE8-B180-DC4BD6467A2F",
            "versionEndExcluding": "7.3.2",
            "versionStartIncluding": "7.3.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.