CyberCVE

CVE-2025-25256

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.

Severity
Critical 9.8
CVSS 3.1
Exploited
Not listed
EPSS
0.647
99.2th percentile
Discovered by
Third party
Vendor advisory field
Published
Aug 12, 2025
Assigned by fortinet

Description

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

Weakness: CWE-78

Affected products

Vendor Product Category Matched by
Fortinet FortiSIEM SIEM & Log Management cna-assigner
Vendor-reported products (1)
  • Fortinet · FortiSIEM

Credit

External

Vendor remediation

Upgrade to FortiSIEM version 7.4.0 or above Upgrade to FortiSIEM version 7.3.2 or above Upgrade to FortiSIEM version 7.2.6 or above Upgrade to FortiSIEM version 7.1.8 or above Upgrade to FortiSIEM version 7.0.4 or above Upgrade to FortiSIEM version 6.7.10 or above

References

Something wrong here?