CVE-2025-52970

Published Aug 12, 2025

Last updated 2 months ago

Fortinet

FortiWeb

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-52970 is a critical authentication bypass vulnerability affecting Fortinet's FortiWeb web application firewall. It stems from improper parameter handling in the application's cookie parsing mechanism. The vulnerability allows unauthenticated remote attackers to impersonate any existing user on affected systems. The vulnerability exploits an out-of-bounds read issue in FortiWeb's cookie handling code, enabling attackers to force the server to use a predictable, all-zero secret key for session encryption and signing. By manipulating the "Era" parameter in session cookies to values between 2 and 9, attackers can trigger the out-of-bounds read that forces the system to use compromised encryption keys.

Description: A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortiweb

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@fortinet.com: CWE-233

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 7

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E739890-CFEA-4B7B-B78D-8CC8157BDF54",
            "versionEndExcluding": "7.0.11",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B642678E-4E31-4A6B-A791-ACD5D332B175",
            "versionEndExcluding": "7.2.11",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA8DE17C-1756-4B18-A956-A52CFA0967B9",
            "versionEndExcluding": "7.4.8",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B739434-1979-43F9-AEC1-D287B1BCA5CA",
            "versionEndExcluding": "7.6.4",
            "versionStartIncluding": "7.6.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.