Fortinet fixed two critical flaws in FortiFone and FortiSIEM
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-47855 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through 3.0.23 allows an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests. NVD description · AI analysis pending | 9.8 | <1% | — | — | ||
| CVE-2025-64155 | Unauthenticated RCE via OS Command Injection in Fortinet FortiSIEM Fortinet FortiSIEM contains an unauthenticated OS command injection flaw (CWE-78) caused by improper neutralization of special elements used in an OS command. A remote attacker can trigger it by sending crafted TCP requests to the vulnerable service, requiring no credentials or user interaction. Successful exploitation allows execution of unauthorized code or commands on the SIEM host, giving an attacker control over a high-value security monitoring platform. Every current FortiSIEM release branch is affected: 7.4.0, 7.3.0 through 7.3.4, 7.1.0 through 7.1.8, 7.0.0 through 7.0.4, and 6.7.0 through 6.7.10. A public proof-of-concept exploit has been released, and EPSS assigns a 43.2% probability of exploitation within 30 days (99th percentile), though the flaw is not yet in CISA KEV and no confirmed in-the-wild exploitation has been reported. Do: Upgrade FortiSIEM to the fixed release specified in Fortinet's advisory for CVE-2025-64155 as soon as possible, since exploitation requires only network reachability and no authentication. Until patched, restrict access to FortiSIEM's network-facing TCP services (management and event-ingestion interfaces) to trusted management networks and sources. Given the public proof-of-concept and high EPSS score, prioritize checking internet-exposed FortiSIEM instances for signs of exploitation and review logs for unexpected command execution. | 9.8 | 45% | PoC |
| largetens of thousands of FortiSIEM deployments worldwide (all current 6.7.x-7.4.x release branches affected) |
Full article390 words · extracted from securityaffairs.com · click to collapse
Fortinet fixed six security flaws, including two critical bugs in FortiFone and FortiSIEM that attackers could exploit without authentication.
Fortinet released patches for six vulnerabilities, including two critical flaws in FortiFone and FortiSIEM that could be exploited without authentication to leak configuration data or enable code execution.
The first vulnerabilty, tracked as CVE-2025-64155 (CVSS score of 9.4), is an improper neutralization of special elements used in an OS command that could led to OS Command Injection. The vulnerability impacts FortiSIEM, an unauthenticated attacker can trigger the issue to execute unauthorized code or commands via crafted TCP requests.
“An improper neutralization of special elements used in an OS command (‘OS Command Injection’) vulnerability [CWE-78] in FortiSIEM may allow an unauthenticated attacker to execute unauthorized code or commands via crafted TCP requests.” reads the advisory.
The flaw impacts the following versions:
| Version | Affected | Solution |
|---|---|---|
| FortiSIEM Cloud | Not affected | Not Applicable |
| FortiSIEM 7.5 | Not affected | Not Applicable |
| FortiSIEM 7.4 | 7.4.0 | Upgrade to 7.4.1 or above |
| FortiSIEM 7.3 | 7.3.0 through 7.3.4 | Upgrade to 7.3.5 or above |
| FortiSIEM 7.2 | 7.2.0 through 7.2.6 | Upgrade to 7.2.7 or above |
| FortiSIEM 7.1 | 7.1.0 through 7.1.8 | Upgrade to 7.1.9 or above |
| FortiSIEM 7.0 | 7.0.0 through 7.0.4 | Migrate to a fixed release |
| FortiSIEM 6.7 | 6.7.0 through 6.7.10 | Migrate to a fixed release |
The researcher Zach Hanley (@hacks_zach) of Horizon3.ai reported the vulnerability.
The vulnerability only impacts the Super and Worker nodes, it does not impact Collector nodes. The vendor recommends limiting access to the phMonitor port (7900) as workaround.
The second critical flaw, tracked as CVE-2025-47855 (CVSS score of 9.3), addressed by Fortinet is an exposure of sensitive information to an unauthorized actor issue in FortiFone Web Portal page.
An unauthenticated attacker can trigger the flaw to obtain the device configuration via crafted HTTP or HTTPS requests.
“An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiFone Web Portal page may allow an unauthenticated attacker to obtain the device configuration via crafted HTTP or HTTPS requests.” reads the advisory.
FortiFone versions 3.0.24 and 7.0.2 addressed the issue. The researcher Théo Leleu from Fortinet Product Security team reported the flaw.
It is unclear if one of the flaws addressed by Fortinet is actively exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, FortiFone)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/186902/security/fortinet-fixed-two-critical-flaws-in-fortifone-and-fortisiem.html