{"id":"CVE-2025-52970","published":"2025-08-12T18:59:25Z","modified":"2026-01-14T13:46:48Z","title":"A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions…","vendor":"Fortinet","product":"FortiWeb","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiWeb","versions":[">= 7.6.0, <= 7.6.3",">= 7.4.0, <= 7.4.7",">= 7.2.0, <= 7.2.10",">= 7.0.0, <= 7.0.10"]}],"description":{"text":"A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.10084,"percentile":0.95621,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-09-04","exploitedFirstSeen":"2025-09-04","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-52970","date":"2025-09-04"},{"url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20251007.pdf","date":"2025-10-07"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"Actualización Fortinet update - 13/08/2025","url":"https://otx.alienvault.com/pulse/689cfba9534d05f2b50a7ef2","created":"2025-08-13"},{"name":"TI Advisory No-ESAF-SOC-TI-166","url":"https://otx.alienvault.com/pulse/689c8f5636807b971834588f","created":"2025-08-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-233","name":"Improper Handling of Parameters"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-448","tags":[]},{"url":"https://pwner.gg/blog/2025-08-13-fortiweb-cve-2025-52970","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-24471","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-24471","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-08-23","earliestUrl":"https://github.com/Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass","repos":[{"name":"Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass","url":"https://github.com/Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass","stars":10,"created":"2025-08-23"},{"name":"34zY/CVE-2025-52970","url":"https://github.com/34zY/CVE-2025-52970","stars":8,"created":"2025-09-07"}]},"nuclei":[{"id":"CVE-2025-52970","name":"Fortinet FortiWeb - Authentication Bypass to Admin Privilege","severity":"high","path":"http/cves/2025/CVE-2025-52970.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-52970.yaml"}],"first":{"date":"2025-08-23","source":"PoC-in-GitHub","url":"https://github.com/Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass"},"provenance":"source"},"exploitRefs":["https://pwner.gg/blog/2025-08-13-fortiweb-cve-2025-52970"],"flow":[],"timeline":[{"date":"2025-08-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-52970","provenance":"source"},{"date":"2025-08-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass","provenance":"source"},{"date":"2025-09-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-52970","provenance":"source"}],"speed":{"daysToPublicExploit":11,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 421 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.12,"detail":"percentile 0.9562"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":5.39,"detail":"base score 7.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}