CVE-2025-64153
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all ver
Severity
Medium 6.7
CVSS 3.1
Exploited
Not listed
EPSS
0.017
76.4th percentile
Discovered by
Vendor
Vendor advisory field
Published
Dec 9, 2025
Assigned by fortinet
Description
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0 through 7.4.7, FortiExtender 7.2 all versions, FortiExtender 7.0 all versions may allow an authenticated attacker to execute unauthorized code or commands via a specific HTTP request.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiExtender | Routing & Switching | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiExtender
Credit
Internally discovered and reported by David Maciejak of Fortinet Product Security team.
Vendor remediation
Upgrade to FortiExtender version 7.6.4 or above Upgrade to FortiExtender version 7.4.8 or above