{"id":"CVE-2025-25256","published":"2025-08-12T18:59:14Z","modified":"2026-08-18T21:09:45Z","title":"An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78]…","vendor":"Fortinet","product":"FortiSIEM","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiSIEM","versions":[">= 7.3.0, <= 7.3.1",">= 7.2.0, <= 7.2.5",">= 7.1.0, <= 7.1.7",">= 7.0.0, <= 7.0.3",">= 6.7.0, <= 6.7.9",">= 6.6.0, <= 6.6.5",">= 6.5.0, <= 6.5.3",">= 6.4.0, <= 6.4.4",">= 6.3.0, <= 6.3.3",">= 6.2.0, <= 6.2.1"]}],"description":{"text":"An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw (CWE-78) in the CLI of Fortinet FortiSIEM, affecting many release lines from 4.7 through 7.3.1. An unauthenticated attacker can execute unauthorized code or commands by sending crafted CLI requests, with no user interaction required and no prior authentication needed over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:37Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.65297,"percentile":0.99253,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-08-12","exploitedFirstSeen":"2025-08-12","ransomware":false,"evidence":[{"url":"https://www.fortiguard.com/psirt/FG-IR-25-152","date":"2025-08-12"},{"url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","date":"2025-09-03"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"August Vulnerabilities of Note","url":"https://otx.alienvault.com/pulse/68ca4a40710f32ec39a3f1ac","created":"2025-09-17"},{"name":"IOC - August Vulnerabilities of Note","url":"https://otx.alienvault.com/pulse/68c906de04a64352bf19cdc0","created":"2025-09-16"},{"name":"August Vulnerabilities of Note","url":"https://otx.alienvault.com/pulse/68c8542d707c703692b65d8f","created":"2025-09-15"},{"name":"Threat Actors Deploy Sinobi Ransomware via Compromised SonicWall SSL VPN Credentials","url":"https://otx.alienvault.com/pulse/68b120148ac1077dfb454c29","created":"2025-08-29"},{"name":"IOC - Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC","url":"https://otx.alienvault.com/pulse/68a7e011cdda1f353cfe7b98","created":"2025-08-22"},{"name":"Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC","url":"https://otx.alienvault.com/pulse/68a7465fd6fcc8556c5059d2","created":"2025-08-21"},{"name":"Threat Actor Profile: Interlock Ransomware.","url":"https://otx.alienvault.com/pulse/68a23a01f165c894110693b6","created":"2025-08-17"},{"name":"ACTUALIZACION | Several vulnerabilities that exploit Fortinet products","url":"https://otx.alienvault.com/pulse/689e238fb99331853cbeaa87","created":"2025-08-14"},{"name":"Actualización Fortinet update - 13/08/2025","url":"https://otx.alienvault.com/pulse/689cfba9534d05f2b50a7ef2","created":"2025-08-13"},{"name":"TI Advisory No-ESAF-SOC-TI-166","url":"https://otx.alienvault.com/pulse/689c8f5636807b971834588f","created":"2025-08-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-152","tags":[]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256","tags":["exploit"]},{"url":"https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/","tags":["technical-description"]},{"url":"https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-24462","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24462","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-08-15","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256","repos":[{"name":"watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256","url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256","stars":19,"created":"2025-08-15"}]},"nuclei":[{"id":"CVE-2025-25256","name":"Fortinet FortiSIEM - OS Command Injection","severity":"critical","path":"network/cves/2025/CVE-2025-25256.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-25256.yaml"}],"first":{"date":"2025-08-15","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256"},"provenance":"source"},"exploitRefs":["https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256"],"flow":[],"timeline":[{"date":"2025-08-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-25256","provenance":"source"},{"date":"2025-08-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortiguard.com/psirt/FG-IR-25-152","provenance":"source"},{"date":"2025-08-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 444 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9925"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}