Fortinet Warns About FortiSIEM Vulnerability (CVE-2025-25256) With In-the
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-25256 | Unauthenticated OS command injection in Fortinet FortiSIEM (CVE-2025-25256) CVE-2025-25256 is a critical (CVSS 9.8) OS command injection flaw (CWE-78) in Fortinet's FortiSIEM SIEM platform. An unauthenticated attacker can trigger it by sending specially crafted CLI requests over the network, which the appliance fails to properly neutralize before execution. Successful exploitation allows the attacker to execute unauthorized code or commands on the affected system without credentials or user interaction, effectively giving control of the appliance. Essentially every currently supported and many older FortiSIEM releases are affected, spanning versions 4.7 through 7.3.1. Fortinet has confirmed exploit code is being used in the wild, and the flaw carries a high 60.3% EPSS probability of exploitation within 30 days, though it is not yet in CISA's KEV catalog. Do: Upgrade FortiSIEM to a fixed release per Fortinet's security advisory, ensuring the deployed version falls outside all affected ranges listed above; given in-the-wild exploitation and a ~60% EPSS probability, prioritize externally reachable instances. Until patched, restrict network access to the appliance's CLI/management-facing services and review logs for unexpected commands or connections that may indicate compromise. | 9.8 | 60% |
| largetens of thousands of deployed FortiSIEM instances worldwide (order-of-magnitude estimate) |
Full article439 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 13, 2025Vulnerability / Network Security
Fortinet is alerting customers of a critical security flaw in FortiSIEM for which it said there exists an exploit in the wild.
The vulnerability, tracked as CVE-2025-25256, carries a CVSS score of 9.8 out of a maximum of 10.0.
"An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests," the company said in a Tuesday advisory.
The following versions are impacted by the flaw -
- FortiSIEM 6.1, 6.2, 6.3, 6.4, 6.5, 6.6 (Migrate to a fixed release)
- FortiSIEM 6.7.0 through 6.7.9 (Upgrade to 6.7.10 or above)
- FortiSIEM 7.0.0 through 7.0.3 (Upgrade to 7.0.4 or above)
- FortiSIEM 7.1.0 through 7.1.7 (Upgrade to 7.1.8 or above)
- FortiSIEM 7.2.0 through 7.2.5 (Upgrade to 7.2.6 or above)
- FortiSIEM 7.3.0 through 7.3.1 (Upgrade to 7.3.2 or above)
- FortiSIEM 7.4 (Not affected)
Fortinet acknowledged in its advisory that a "practical exploit code for this vulnerability was found in the wild," but did not share any additional specifics about the nature of the exploit and where it was found. It also noted that the exploitation code does not appear to produce distinctive indicators of compromise (IoCs).
As workarounds, the network security company is recommending that organizations limit access to the phMonitor port (7900).
The disclosure comes a day after GreyNoise warned of a "significant spike" in brute-force traffic aimed at Fortinet SSL VPN devices, with dozens of IP addresses from the United States, Canada, Russia, and the Netherlands probing devices located across the world.
Update
In a follow-up analysis, watchTowr Labs said phMonitor is a C++ binary that's responsible for monitoring the health of FortiSIEM processes. It works by listening on port 7900, using a custom RPC protocol wrapped in TLS.
The vulnerability, the cybersecurity company added, is rooted in a function named "phMonitorProcess::handleStorageArchiveRequest" and stems from an inadequate sanitization of user inputs, which could then be exploited to achieve command injection.
"Under the hood, addParaSafe simply escaped quotes to try and stop input from breaking out of a surrounding literal string – a weak defense against command injection," security researcher Sina Kheirkhah said.
As a result, an attacker could weaponize the flaw by supplying a specially crafted XML payload to run arbitrary shell commands on the underlying operating system.
(The story was updated after publication on August 18, 2025, to include an analysis of the flaw from watchTowr Labs.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/08/fortinet-warns-about-fortisiem.html