CVE-2025-64156
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all ver
Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.003
25.5th percentile
Discovered by
Vendor
Vendor advisory field
Published
Dec 9, 2025
Assigned by fortinet
Description
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests
Weakness: CWE-89
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiVoice | Other Products | cna-assigner |
Vendor-reported products (1)
- Fortinet · FortiVoice
Credit
Internally discovered and reported by David Maciejak of Fortinet Product Security team.
Vendor remediation
Upgrade to FortiVoice version 7.2.3 or above Upgrade to FortiVoice version 7.0.8 or above