← Back to browse · API

CVE-2025-25256

Severity
CRITICAL
CVSS
9.8
EPSS
0.60344
Risk score
60.32
CISA KEV
No
PoC
No
Published
2025-08-12
Modified
2026-02-26
First seen
2026-08-07
Aliases
EUVD-2025-24462, GHSA-6GXF-4W6M-J956
Products
Fortinet:FortiSIEM 5.4.0, Fortinet:FortiSIEM 6.1.0 ≤6.1.2, Fortinet:FortiSIEM 6.2.0 ≤6.2.1, Fortinet:FortiSIEM 6.3.0 ≤6.3.3, Fortinet:FortiSIEM 6.4.0 ≤6.4.4, Fortinet:FortiSIEM 6.5.0 ≤6.5.3, Fortinet:FortiSIEM 6.6.0 ≤6.6.5, Fortinet:FortiSIEM 6.7.0 ≤6.7.9, Fortinet:FortiSIEM 7.0.0 ≤7.0.3, Fortinet:FortiSIEM 7.1.0 ≤7.1.7, Fortinet:FortiSIEM 7.2.0 ≤7.2.5, Fortinet:FortiSIEM 7.3.0 ≤7.3.1
Sources
euvd EUVD-2025-24462

Description

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

References