CyberCVE

CVE-2025-52970

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker

Severity
High 7.7
CVSS 3.1
Exploited
Not listed
EPSS
0.098
95.1th percentile
Discovered by
Not disclosed
Published
Aug 12, 2025
Assigned by fortinet

Description

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Weakness: CWE-233

Affected products

Vendor Product Category Matched by
Fortinet FortiWeb Web & Application Security cna-assigner
Vendor-reported affected versions (1)
  • Fortinet · FortiWeb

Vendor remediation

Upgrade to FortiWeb version 8.0.0 or above Upgrade to FortiWeb version 7.6.4 or above Upgrade to FortiWeb version 7.4.8 or above Upgrade to FortiWeb version 7.2.11 or above Upgrade to FortiWeb version 7.0.11 or above

References