CVE-2025-25256
Fortinet FortiSIEM OS Command Injection
Description
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
INFO
Published Date :
Aug. 12, 2025, 7:15 p.m.
Last Modified :
Aug. 15, 2025, 6:15 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | [email protected] |
Solution
- Update to a fixed Fortinet FortiSIEM version.
- Apply security patches provided by Fortinet.
Public PoC/Exploit Available at Github
CVE-2025-25256 has a 7 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-25256.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-25256 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-25256
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CVE-2025-25256: Fortinet FortiSIEM OS Command Injection CVE PoC (Proof of Concept)
None
Python
CVE-2025-25256: Fortinet FortiSIEM OS Command Injection PoC
None
None
A collection of Vulnerability Research and Reverse Engineering writeups.
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
security cve exploit poc vulnerability
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-25256 vulnerability anywhere in the article.
-
Help Net Security
PoC exploit for critical FortiSIEM vulnerability released (CVE-2025-64155)
A critical vulnerability (CVE-2025-64155) in Fortinet’s FortiSIEM security platform has now been accompanied by publicly released proof-of-concept (PoC) exploit code, raising the urgency for organizat ... Read more
-
BleepingComputer
Exploit code public for critical FortiSIEM command injection flaw
Technical details and a public exploit have been published for a critical vulnerability affecting Fortinet's Security Information and Event Management (SIEM) solution that could be leveraged by a remo ... Read more
-
CybersecurityNews
New One-Click Microsoft Copilot Vulnerability Grants Attackers Undetected Access to Sensitive Data
A novel single-click attack targeting Microsoft Copilot Personal that enables attackers to silently exfiltrate sensitive user data. The vulnerability, now patched, allowed threat actors to hijack sess ... Read more
-
CybersecurityNews
Critical FortiSIEM Vulnerability(CVE-2025-64155) Enable Full RCE and Root Compromise
In August 2025, Fortinet issued an advisory for CVE-2025-25256, an OS command injection vulnerability (CWE-78) in FortiSIEM that exposed the platform to unauthenticated remote code execution via craft ... Read more
-
TheCyberThrone
CVE-2025-64155 – Critical RCE in Fortinet FortiSIEM
January 14, 2026Fortinet patched a severe unauthenticated remote command injection flaw in FortiSIEM on January 13, 2026, tracked as CVE-2025-64155 with CVSS 9.4.Discovered by Horizon3.ai in August 20 ... Read more
-
Daily CyberSecurity
Fortinet Critical Alert: CVE-2025-64155 RCE & Config Leaks Exposed
Fortinet has issued a sweeping set of security advisories, patching critical vulnerabilities across its product ecosystem that could allow attackers to execute arbitrary code, delete files, or hijack ... Read more
-
BleepingComputer
Fortinet warns of critical FortiCloud SSO login auth bypass flaws
Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authenticati ... Read more
-
BleepingComputer
CISA gives govt agencies 7 days to patch new Fortinet flaw
CISA has ordered U.S. government agencies to secure their systems within a week against another vulnerability in Fortinet's FortiWeb web application firewall, which was exploited in zero-day attacks. ... Read more
-
BleepingComputer
Fortinet warns of new FortiWeb zero-day exploited in attacks
Today, Fortinet released security updates to patch a new FortiWeb zero-day vulnerability that threat actors are actively exploiting in attacks. Tracked as CVE-2025-58034, this web application firewall ... Read more
-
BleepingComputer
Fortinet confirms silent patch for FortiWeb zero-day exploited in attacks
Fortinet has confirmed that it has silently patched a critical zero-day vulnerability in its FortiWeb web application firewall, which is now "massively exploited in the wild." The announcement follows ... Read more
-
TheCyberThrone
TheCyberThrone CyberSecurity Newsletter Top 5 Articles – August 2025
September 7, 2025Welcome to TheCyberThrone cybersecurity month in review will be posted covering the important security happenings . This review is for the month ending July 2025Subscribers favorite # ... Read more
-
The Cyber Express
New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes
A new HTTP/2 denial of service (DoS) vulnerability that circumvents mitigations put in place after 2023’s “Rapid Reset” vulnerability is largely being addressed by affected vendors and projects, thank ... Read more
-
CybersecurityNews
Weekly Cybersecurity News Recap : Microsoft, Cisco, Fortinet Security Updates and Cyber Attacks
In the week of August 11-17, 2025, the cybersecurity landscape was marked by critical updates from major vendors and a surge in sophisticated threats, underscoring the ongoing battle against digital v ... Read more
-
Help Net Security
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the onl ... Read more
-
CybersecurityNews
Hackers Mimic IT Teams to Exploit Microsoft Teams Request to Gain System Remote Access
A sophisticated social engineering campaign by the EncryptHub threat group that combines impersonation tactics with technical exploitation to compromise corporate networks. The Russian-linked cybercri ... Read more
-
CybersecurityNews
Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-25256) – Technical Details Revealed
Cybersecurity researchers from watchTowr Labs have published a comprehensive technical analysis of a critical pre-authentication command injection vulnerability affecting Fortinet FortiSIEM systems, d ... Read more
-
The Cyber Express
Qilin Remains Top Ransomware Group as Attacks Rise
Qilin continues to stake a claim as the top ransomware group in the wake of the decline of RansomHub earlier this year. In July, Qilin led all ransomware groups in claimed victims for the third time i ... Read more
-
Help Net Security
Brute-force attacks hammer Fortinet devices worldwide
A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabi ... Read more
-
The Cyber Express
Zoom Urges Windows Users to Update After Severe CVE-2025-49457 Security Flaw
A critical security vulnerability has recently been discovered in certain versions of Zoom Clients for Windows that could expose users to cybersecurity risks, including privilege escalation via networ ... Read more
-
security.nl
Fortinet dicht kritiek FortiSIEM-lek waarvoor exploitcode online is gevonden
Fortinet heeft een kritieke kwetsbaarheid in FortiSIEM gedicht waardoor een ongeauthenticeerde aanvaller code of commando's op het systeem kan uitvoeren. Volgens Fortinet is er exploitcode voor de kwe ... Read more
The following table lists the changes that have been made to the
CVE-2025-25256 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 15, 2025
Action Type Old Value New Value Added Reference https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256 Added Reference https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/ -
Initial Analysis by [email protected]
Aug. 13, 2025
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 5.4.0 up to (excluding) 6.7.10 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (excluding) 7.0.4 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.1.0 up to (excluding) 7.1.8 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.2.0 up to (excluding) 7.2.6 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.3.0 up to (excluding) 7.3.2 Added Reference Type Fortinet, Inc.: https://fortiguard.fortinet.com/psirt/FG-IR-25-152 Types: Vendor Advisory Added Reference Type CVE: https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/ Types: Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Aug. 13, 2025
Action Type Old Value New Value Added Reference https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/ -
New CVE Received by [email protected]
Aug. 12, 2025
Action Type Old Value New Value Added Description An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-78 Added Reference https://fortiguard.fortinet.com/psirt/FG-IR-25-152