CVE-2025-47856
Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allo
Severity
High 7.2
CVSS 3.1
Exploited
Not listed
EPSS
0.013
69.7th percentile
Discovered by
Vendor
Vendor advisory field
Published
Oct 14, 2025
Assigned by fortinet
Description
Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiVoice | Other Products | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiVoice
Credit
Internal
Vendor remediation
Please upgrade to FortiVoice version 7.2.1 or above Please upgrade to FortiVoice version 7.0.7 or above Please upgrade to FortiVoice version 6.4.11 or above