CVE-2025-52970

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker

Severity

High 7.7

CVSS 3.1

Exploited

Not listed

EPSS

0.101

95.4th percentile

Discovered by

Third party

Vendor advisory field

Published

Aug 12, 2025

Assigned by fortinet

Description

A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.

Weakness: CWE-233

Affected products

Vendor	Product	Category	Matched by
Fortinet	FortiWeb	Web & Application Security	cna-assigner

Vendor-reported products (1)

Fortinet · FortiWeb

Credit

Fortinet is pleased to thank Aviv Y (@0x_shaq) for reporting this vulnerability under responsible disclosure.

Vendor remediation

Upgrade to FortiWeb version 8.0.0 or above Upgrade to FortiWeb version 7.6.4 or above Upgrade to FortiWeb version 7.4.8 or above Upgrade to FortiWeb version 7.2.11 or above Upgrade to FortiWeb version 7.0.11 or above

References

Something wrong here?