Fortinet Warns Exploit Code Available for Critical Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-25256 | Unauthenticated OS command injection in Fortinet FortiSIEM (CVE-2025-25256) CVE-2025-25256 is a critical (CVSS 9.8) OS command injection flaw (CWE-78) in Fortinet's FortiSIEM SIEM platform. An unauthenticated attacker can trigger it by sending specially crafted CLI requests over the network, which the appliance fails to properly neutralize before execution. Successful exploitation allows the attacker to execute unauthorized code or commands on the affected system without credentials or user interaction, effectively giving control of the appliance. Essentially every currently supported and many older FortiSIEM releases are affected, spanning versions 4.7 through 7.3.1. Fortinet has confirmed exploit code is being used in the wild, and the flaw carries a high 60.3% EPSS probability of exploitation within 30 days, though it is not yet in CISA's KEV catalog. Do: Upgrade FortiSIEM to a fixed release per Fortinet's security advisory, ensuring the deployed version falls outside all affected ranges listed above; given in-the-wild exploitation and a ~60% EPSS probability, prioritize externally reachable instances. Until patched, restrict network access to the appliance's CLI/management-facing services and review logs for unexpected commands or connections that may indicate compromise. | 9.8 | 60% |
| largetens of thousands of deployed FortiSIEM instances worldwide (order-of-magnitude estimate) |
Full article334 words · extracted from infosecurity-magazine.com · click to collapse
Sysadmins have been urged to prioritize updating a new critical vulnerability in Fortinet’s FortiSIEM solution, as exploit code is currently circulating in the wild.
Published on Tuesday, CVE-2025-25256 is an escalation of privilege vulnerability with a CVSS score of 9.8.
“An improper neutralization of special elements used in an OS command vulnerability in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests,” the advisory explained.
“Practical exploit code for this vulnerability was found in the wild.”
Fortinet added that the exploitation code currently circulating “does not appear to produce distinctive IoCs [indicators of compromise],” which will complicate network defender efforts to identify and contain any resulting exploits.
Read more on Fortinet threats: Fortinet Confirms Critical Zero-Day Vulnerability in Firewalls
FortiSIEM is a security information and event management (SIEM) platform designed to provide security operations (SecOps) teams with threat alerts based on analysis and correlation of data from multiple sources.
It’s marketed mainly to medium and large enterprises and managed service providers, putting these organizations in the crosshairs of possible attack if workable exploits are developed.
Fortinet products are a popular target for threat actors, with vulnerabilities often exploited in ransomware campaigns.
It’s unclear whether the announcement is related to a report from GreyNoise, also released on Tuesday, which revealed a “significant spike in brute-force traffic targeting Fortinet SSL VPNs.”
Over 780 unique IPs were involved in the attacks, traced to August 3. GreyNoise said this was the highest volume of IPs associated with attacks on Fortinet SSL VPNs in recent months.
“New research shows spikes like this often precede the disclosure of new vulnerabilities affecting the same vendor – most within six weeks,” it explained.
“In fact, GreyNoise found that spikes in activity triggering this exact tag are significantly correlated with future disclosed vulnerabilities in Fortinet products.”
On August 5, the same threat actor switched from targeting FortiOS SSL VPN endpoints to FortiManager’s FGFM service, the threat intelligence firm said.
Image credit: Michael Vi / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fortinet-exploit-code-available/