CVE-2025-64155

Published Jan 13, 2026

Last updated 7 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64155 is an OS Command Injection vulnerability affecting Fortinet FortiSIEM's Super and Worker nodes. This flaw allows an unauthenticated attacker to execute unauthorized code or commands by sending specially crafted TCP requests. The vulnerability resides within the phMonitor service, which operates on TCP port 7900 and is responsible for inter-node communication and data exchange within FortiSIEM deployments. Exploitation of CVE-2025-64155 stems from improper neutralization of user-supplied input to an unauthenticated API endpoint exposed by the phMonitor service. This can lead to arbitrary file writes and, subsequently, privilege escalation to gain full administrative control and root access on the affected appliance. Fortinet has released patches to address this issue, and a recommended workaround involves limiting access to the phMonitor port (7900).

Description: An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortisiem

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@fortinet.com: CWE-78

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 26

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "409EC360-68C2-4098-AC99-8310913D8EC0",
            "versionEndExcluding": "7.1.9",
            "versionStartIncluding": "6.7.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2A8C7360-73D5-4629-B1C3-47B6C7AD9678",
            "versionEndExcluding": "7.2.7",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C41BBF42-F97A-4358-ADB6-9762BD8F3CAE",
            "versionEndExcluding": "7.3.5",
            "versionStartIncluding": "7.3.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortisiem:7.4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "500DAB25-48C9-48C7-B7CD-92C06989F039"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.