CVE-2025-25256

9.8

CRITICAL CVSS 3.1

Fortinet FortiSIEM OS Command Injection

Description

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

INFO

Published Date :

Aug. 12, 2025, 7:15 p.m.

Last Modified :

Aug. 15, 2025, 6:15 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

Affected Products

The following products are affected by CVE-2025-25256 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Fortinet	fortisiem

: Total Affected Vendor : 1 | Products : 1

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]

Solution

Update Fortinet FortiSIEM to a patched version to prevent OS command injection.

Update to a fixed Fortinet FortiSIEM version.
Apply security patches provided by Fortinet.

Public PoC/Exploit Available at Github

CVE-2025-25256 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-25256.

URL	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-152	Vendor Advisory
https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/	Third Party Advisory
https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256
https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-25256 is associated with the following CWEs:

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-25256 weaknesses.

CAPEC-6: Argument Injection Argument Injection CAPEC-15: Command Delimiters Command Delimiters CAPEC-43: Exploiting Multiple Input Interpretation Layers Exploiting Multiple Input Interpretation Layers CAPEC-88: OS Command Injection OS Command Injection CAPEC-108: Command Line Execution through SQL Injection Command Line Execution through SQL Injection

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

JMS-Security/CVE-2025-25256-PoC

CVE-2025-25256: Fortinet FortiSIEM OS Command Injection CVE PoC (Proof of Concept)

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 21, 2025, 9:09 a.m. This repo has been linked 1 different CVEs too.

watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256

None

Python

Updated: 1 week, 6 days ago

16 stars 3 fork 3 watcher

Born at : Aug. 15, 2025, 2:31 p.m. This repo has been linked 1 different CVEs too.

barbaraeivyu/CVE-2025-25256

CVE-2025-25256: Fortinet FortiSIEM OS Command Injection PoC

Updated: 2 weeks, 3 days ago

2 stars 1 fork 1 watcher

Born at : Aug. 13, 2025, 1:21 p.m. This repo has been linked 1 different CVEs too.

barbaraeivyu/barbaraeivyu

None

Updated: 2 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : Aug. 9, 2025, 9:26 p.m. This repo has been linked 2 different CVEs too.

yembors64632/cve_monitor_Public

None

Updated: 2 weeks, 5 days ago

1 stars 0 fork 0 watcher

Born at : July 23, 2025, 11:54 a.m. This repo has been linked 88 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 day, 4 hours ago

7238 stars 1202 fork 1202 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 800 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-25256 vulnerability anywhere in the article.

The Cyber Express

New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes

A new HTTP/2 denial of service (DoS) vulnerability that circumvents mitigations put in place after 2023’s “Rapid Reset” vulnerability is largely being addressed by affected vendors and projects, thank ...

Published Date: Aug 18, 2025 (2 weeks, 1 day ago)

CybersecurityNews

Weekly Cybersecurity News Recap : Microsoft, Cisco, Fortinet Security Updates and Cyber Attacks

In the week of August 11-17, 2025, the cybersecurity landscape was marked by critical updates from major vendors and a surge in sophisticated threats, underscoring the ongoing battle against digital v ...

Published Date: Aug 17, 2025 (2 weeks, 2 days ago)

Help Net Security

Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the onl ...

Published Date: Aug 17, 2025 (2 weeks, 2 days ago)

CybersecurityNews

Hackers Mimic IT Teams to Exploit Microsoft Teams Request to Gain System Remote Access

A sophisticated social engineering campaign by the EncryptHub threat group that combines impersonation tactics with technical exploitation to compromise corporate networks. The Russian-linked cybercri ...

Published Date: Aug 16, 2025 (2 weeks, 3 days ago)

CybersecurityNews

Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-25256) – Technical Details Revealed

Cybersecurity researchers from watchTowr Labs have published a comprehensive technical analysis of a critical pre-authentication command injection vulnerability affecting Fortinet FortiSIEM systems, d ...

Published Date: Aug 16, 2025 (2 weeks, 3 days ago)

The Cyber Express

Qilin Remains Top Ransomware Group as Attacks Rise

Qilin continues to stake a claim as the top ransomware group in the wake of the decline of RansomHub earlier this year. In July, Qilin led all ransomware groups in claimed victims for the third time i ...

Published Date: Aug 15, 2025 (2 weeks, 3 days ago)

Help Net Security

Brute-force attacks hammer Fortinet devices worldwide

A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabi ...

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)

The Cyber Express

Zoom Urges Windows Users to Update After Severe CVE-2025-49457 Security Flaw

A critical security vulnerability has recently been discovered in certain versions of Zoom Clients for Windows that could expose users to cybersecurity risks, including privilege escalation via networ ...

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)

security.nl

Fortinet dicht kritiek FortiSIEM-lek waarvoor exploitcode online is gevonden

Fortinet heeft een kritieke kwetsbaarheid in FortiSIEM gedicht waardoor een ongeauthenticeerde aanvaller code of commando's op het systeem kan uitvoeren. Volgens Fortinet is er exploitcode voor de kwe ...

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)

The Cyber Express

CISA Warns of Active Exploits in N-able N-central, Urges Upgrade to 2025.3.1

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two high-risk vulnerabilities in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations ...

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)

TheCyberThrone

CISA adds WinRAR and Microsoft vulnerabilities to KEV catalog

August 14, 2025The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added new Microsoft and WinRAR vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to ...

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)

TheCyberThrone

CVE-2025-25256 affects FortiSIEM

August 14, 20251. Vulnerability OverviewCVE-2025-25256 is a critical command injection bug in Fortinet FortiSIEM’s phMonitor service, exposed on TCP port 7900. It enables unauthenticated remote attack ...

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)

BleepingComputer

Fortinet warns of FortiSIEM pre-auth RCE flaw with exploit in the wild

Fortinet is warning about a remote unauthenticated command injection flaw in FortiSIEM that has in-the-wild exploit code, making it critical for admins to apply the latest security updates. FortiSIEM ...

Published Date: Aug 13, 2025 (2 weeks, 5 days ago)

The Register

Fortinet discloses critical bug with working exploit code amid surge in brute-force attempts

Fortinet warned customers about a critical FortiSIEM bug that could allow an unauthenticated attacker to execute unauthorized commands, and said working exploit code for the flaw has been found in the ...