CVE-2025-25256
Fortinet FortiSIEM OS Command Injection
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
INFO
Published Date :
Aug. 12, 2025, 7:15 p.m.
Last Modified :
Aug. 15, 2025, 6:15 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update to a fixed Fortinet FortiSIEM version.
- Apply security patches provided by Fortinet.
Public PoC/Exploit Available at Github
CVE-2025-25256 has a 7 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-25256.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-25256 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-25256
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2025-25256: Fortinet FortiSIEM OS Command Injection CVE PoC (Proof of Concept)
None
Python
CVE-2025-25256: Fortinet FortiSIEM OS Command Injection PoC
None
None
EPSS & VEDAS Score Aggregator for CVEs
cve vulnerability exploit epss vedas exploit-maturity
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-25256 vulnerability anywhere in the article.
-
TheCyberThrone
TheCyberThrone CyberSecurity Newsletter Top 5 Articles – August 2025
September 7, 2025Welcome to TheCyberThrone cybersecurity month in review will be posted covering the important security happenings . This review is for the month ending July 2025Subscribers favorite # ... Read more
-
The Cyber Express
New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes
A new HTTP/2 denial of service (DoS) vulnerability that circumvents mitigations put in place after 2023’s “Rapid Reset” vulnerability is largely being addressed by affected vendors and projects, thank ... Read more
-
CybersecurityNews
Weekly Cybersecurity News Recap : Microsoft, Cisco, Fortinet Security Updates and Cyber Attacks
In the week of August 11-17, 2025, the cybersecurity landscape was marked by critical updates from major vendors and a surge in sophisticated threats, underscoring the ongoing battle against digital v ... Read more
-
Help Net Security
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the onl ... Read more
-
CybersecurityNews
Hackers Mimic IT Teams to Exploit Microsoft Teams Request to Gain System Remote Access
A sophisticated social engineering campaign by the EncryptHub threat group that combines impersonation tactics with technical exploitation to compromise corporate networks. The Russian-linked cybercri ... Read more
-
CybersecurityNews
Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-25256) – Technical Details Revealed
Cybersecurity researchers from watchTowr Labs have published a comprehensive technical analysis of a critical pre-authentication command injection vulnerability affecting Fortinet FortiSIEM systems, d ... Read more
-
The Cyber Express
Qilin Remains Top Ransomware Group as Attacks Rise
Qilin continues to stake a claim as the top ransomware group in the wake of the decline of RansomHub earlier this year. In July, Qilin led all ransomware groups in claimed victims for the third time i ... Read more
-
Help Net Security
Brute-force attacks hammer Fortinet devices worldwide
A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabi ... Read more
-
The Cyber Express
Zoom Urges Windows Users to Update After Severe CVE-2025-49457 Security Flaw
A critical security vulnerability has recently been discovered in certain versions of Zoom Clients for Windows that could expose users to cybersecurity risks, including privilege escalation via networ ... Read more
-
security.nl
Fortinet dicht kritiek FortiSIEM-lek waarvoor exploitcode online is gevonden
Fortinet heeft een kritieke kwetsbaarheid in FortiSIEM gedicht waardoor een ongeauthenticeerde aanvaller code of commando's op het systeem kan uitvoeren. Volgens Fortinet is er exploitcode voor de kwe ... Read more
-
The Cyber Express
CISA Warns of Active Exploits in N-able N-central, Urges Upgrade to 2025.3.1
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two high-risk vulnerabilities in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations ... Read more
-
TheCyberThrone
CISA adds WinRAR and Microsoft vulnerabilities to KEV catalog
August 14, 2025The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added new Microsoft and WinRAR vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to ... Read more
-
TheCyberThrone
CVE-2025-25256 affects FortiSIEM
August 14, 20251. Vulnerability OverviewCVE-2025-25256 is a critical command injection bug in Fortinet FortiSIEM’s phMonitor service, exposed on TCP port 7900. It enables unauthenticated remote attack ... Read more
-
BleepingComputer
Fortinet warns of FortiSIEM pre-auth RCE flaw with exploit in the wild
Fortinet is warning about a remote unauthenticated command injection flaw in FortiSIEM that has in-the-wild exploit code, making it critical for admins to apply the latest security updates. FortiSIEM ... Read more
-
The Register
Fortinet discloses critical bug with working exploit code amid surge in brute-force attempts
Fortinet warned customers about a critical FortiSIEM bug that could allow an unauthenticated attacker to execute unauthorized commands, and said working exploit code for the flaw has been found in the ... Read more
-
The Cyber Express
Fortinet Issues Emergency Patch for Actively Exploited Critical FortiSIEM Bug
Fortinet has urgently notified users of a critical OS command injection vulnerability in its FortiSIEM platform, identified as CVE-2025-25256, which is now being actively exploited in the wild. Accord ... Read more
-
Help Net Security
Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779)
For August 2025 Patch Tuesday, Microsoft has released security updates resolving 100+ security vulnerabilities in its various solutions, including a relative path traversal flaw in Windows Kerberos (C ... Read more
-
The Hacker News
Fortinet Warns About FortiSIEM Vulnerability (CVE-2025-25256) With In-the-Wild Exploit Code
Aug 13, 2025Ravie LakshmananVulnerability / Network Security Fortinet is alerting customers of a critical security flaw in FortiSIEM for which it said there exists an exploit in the wild. The vulner ... Read more
-
Help Net Security
Fortinet warns about FortiSIEM vulnerability with in-the-wild exploit code (CVE-2025-25256)
Fortinet has released patches for a critical OS command injection vulnerability (CVE-2025-25256) in FortiSIEM, after practical exploit code surfaced in the wild. About CVE-2025-25256 FortiSIEM is a se ... Read more
-
CybersecurityNews
Critical FortiSIEM Vulnerability Lets Attackers Execute Malicious Commands – PoC Found in the Wild
A critical security vulnerability in the Fortinet FortiSIEM platform allows unauthenticated attackers to execute arbitrary commands remotely. The vulnerability CVE-2025-25256, classified as CWE-78 (OS ... Read more
The following table lists the changes that have been made to the
CVE-2025-25256 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 15, 2025
Action Type Old Value New Value Added Reference https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256 Added Reference https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/ -
Initial Analysis by [email protected]
Aug. 13, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 5.4.0 up to (excluding) 6.7.10 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (excluding) 7.0.4 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.1.0 up to (excluding) 7.1.8 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.2.0 up to (excluding) 7.2.6 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.3.0 up to (excluding) 7.3.2 Added Reference Type Fortinet, Inc.: https://fortiguard.fortinet.com/psirt/FG-IR-25-152 Types: Vendor Advisory Added Reference Type CVE: https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/ Types: Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Aug. 13, 2025
Action Type Old Value New Value Added Reference https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/ -
New CVE Received by [email protected]
Aug. 12, 2025
Action Type Old Value New Value Added Description An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://fortiguard.fortinet.com/psirt/FG-IR-25-152