9.8
CRITICAL CVSS 3.1
CVE-2025-25256
Fortinet FortiSIEM OS Command Injection
Description

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

INFO

Published Date :

Aug. 12, 2025, 7:15 p.m.

Last Modified :

Aug. 15, 2025, 6:15 p.m.

Remotely Exploit :

Yes !
Affected Products

The following products are affected by CVE-2025-25256 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Fortinet fortisiem
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL [email protected]
Solution
Update Fortinet FortiSIEM to a patched version to prevent OS command injection.
  • Update to a fixed Fortinet FortiSIEM version.
  • Apply security patches provided by Fortinet.
Public PoC/Exploit Available at Github

CVE-2025-25256 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-25256 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

CVE-2025-25256: Fortinet FortiSIEM OS Command Injection CVE PoC (Proof of Concept)

Updated: 1 week, 5 days ago
0 stars 0 fork 0 watcher
Born at : Aug. 21, 2025, 9:09 a.m. This repo has been linked 1 different CVEs too.

None

Python

Updated: 1 week, 6 days ago
16 stars 3 fork 3 watcher
Born at : Aug. 15, 2025, 2:31 p.m. This repo has been linked 1 different CVEs too.

CVE-2025-25256: Fortinet FortiSIEM OS Command Injection PoC

Updated: 2 weeks, 4 days ago
2 stars 1 fork 1 watcher
Born at : Aug. 13, 2025, 1:21 p.m. This repo has been linked 1 different CVEs too.

None

Updated: 2 weeks, 4 days ago
0 stars 0 fork 0 watcher
Born at : Aug. 9, 2025, 9:26 p.m. This repo has been linked 2 different CVEs too.

None

Updated: 2 weeks, 5 days ago
1 stars 0 fork 0 watcher
Born at : July 23, 2025, 11:54 a.m. This repo has been linked 88 different CVEs too.

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 1 day, 8 hours ago
7238 stars 1202 fork 1202 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 800 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-25256 vulnerability anywhere in the article.

  • The Cyber Express
New HTTP/2 DoS Vulnerability Prompts Vendor and Project Fixes

A new HTTP/2 denial of service (DoS) vulnerability that circumvents mitigations put in place after 2023’s “Rapid Reset” vulnerability is largely being addressed by affected vendors and projects, thank ... Read more

Published Date: Aug 18, 2025 (2 weeks, 1 day ago)
  • CybersecurityNews
Weekly Cybersecurity News Recap : Microsoft, Cisco, Fortinet Security Updates and Cyber Attacks

In the week of August 11-17, 2025, the cybersecurity landscape was marked by critical updates from major vendors and a surge in sophisticated threats, underscoring the ongoing battle against digital v ... Read more

Published Date: Aug 17, 2025 (2 weeks, 2 days ago)
  • Help Net Security
Week in review: 2 threat actors exploiting WinRAR 0-day, Microsoft fixes “BadSuccessor” Kerberos flaw

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: WinRAR zero-day was exploited by two threat actors (CVE-2025-8088) The RomCom attackers aren’t the onl ... Read more

Published Date: Aug 17, 2025 (2 weeks, 2 days ago)
  • CybersecurityNews
Hackers Mimic IT Teams to Exploit Microsoft Teams Request to Gain System Remote Access

A sophisticated social engineering campaign by the EncryptHub threat group that combines impersonation tactics with technical exploitation to compromise corporate networks. The Russian-linked cybercri ... Read more

Published Date: Aug 16, 2025 (2 weeks, 3 days ago)
  • CybersecurityNews
Fortinet FortiSIEM Command Injection Vulnerability (CVE-2025-25256) – Technical Details Revealed

Cybersecurity researchers from watchTowr Labs have published a comprehensive technical analysis of a critical pre-authentication command injection vulnerability affecting Fortinet FortiSIEM systems, d ... Read more

Published Date: Aug 16, 2025 (2 weeks, 3 days ago)
  • The Cyber Express
Qilin Remains Top Ransomware Group as Attacks Rise

Qilin continues to stake a claim as the top ransomware group in the wake of the decline of RansomHub earlier this year. In July, Qilin led all ransomware groups in claimed victims for the third time i ... Read more

Published Date: Aug 15, 2025 (2 weeks, 4 days ago)
  • Help Net Security
Brute-force attacks hammer Fortinet devices worldwide

A surge in brute-force attempts targeting Fortinet SSL VPNs that was spotted earlier this month could be a portent of imminent attacks leveraging currently undisclosed (potentially zero-day) vulnerabi ... Read more

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)
  • The Cyber Express
Zoom Urges Windows Users to Update After Severe CVE-2025-49457 Security Flaw

A critical security vulnerability has recently been discovered in certain versions of Zoom Clients for Windows that could expose users to cybersecurity risks, including privilege escalation via networ ... Read more

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)
  • security.nl
Fortinet dicht kritiek FortiSIEM-lek waarvoor exploitcode online is gevonden

Fortinet heeft een kritieke kwetsbaarheid in FortiSIEM gedicht waardoor een ongeauthenticeerde aanvaller code of commando's op het systeem kan uitvoeren. Volgens Fortinet is er exploitcode voor de kwe ... Read more

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)
  • The Cyber Express
CISA Warns of Active Exploits in N-able N-central, Urges Upgrade to 2025.3.1

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two high-risk vulnerabilities in N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, warning organizations ... Read more

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)
  • TheCyberThrone
CISA adds WinRAR and Microsoft vulnerabilities to KEV catalog

August 14, 2025The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added new Microsoft and WinRAR vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog due to ... Read more

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)
  • TheCyberThrone
CVE-2025-25256 affects FortiSIEM

August 14, 20251. Vulnerability OverviewCVE-2025-25256 is a critical command injection bug in Fortinet FortiSIEM’s phMonitor service, exposed on TCP port 7900. It enables unauthenticated remote attack ... Read more

Published Date: Aug 14, 2025 (2 weeks, 5 days ago)
  • BleepingComputer
Fortinet warns of FortiSIEM pre-auth RCE flaw with exploit in the wild

Fortinet is warning about a remote unauthenticated command injection flaw in FortiSIEM that has in-the-wild exploit code, making it critical for admins to apply the latest security updates. FortiSIEM ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • The Register
Fortinet discloses critical bug with working exploit code amid surge in brute-force attempts

Fortinet warned customers about a critical FortiSIEM bug that could allow an unauthenticated attacker to execute unauthorized commands, and said working exploit code for the flaw has been found in the ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • The Cyber Express
Fortinet Issues Emergency Patch for Actively Exploited Critical FortiSIEM Bug

Fortinet has urgently notified users of a critical OS command injection vulnerability in its FortiSIEM platform, identified as CVE-2025-25256, which is now being actively exploited in the wild. Accord ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • Help Net Security
Microsoft fixes “BadSuccessor” Kerberos vulnerability (CVE-2025-53779)

For August 2025 Patch Tuesday, Microsoft has released security updates resolving 100+ security vulnerabilities in its various solutions, including a relative path traversal flaw in Windows Kerberos (C ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • The Hacker News
Fortinet Warns About FortiSIEM Vulnerability (CVE-2025-25256) With In-the-Wild Exploit Code

Aug 13, 2025Ravie LakshmananVulnerability / Network Security Fortinet is alerting customers of a critical security flaw in FortiSIEM for which it said there exists an exploit in the wild. The vulner ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • Help Net Security
Fortinet warns about FortiSIEM vulnerability with in-the-wild exploit code (CVE-2025-25256)

Fortinet has released patches for a critical OS command injection vulnerability (CVE-2025-25256) in FortiSIEM, after practical exploit code surfaced in the wild. About CVE-2025-25256 FortiSIEM is a se ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • CybersecurityNews
Critical FortiSIEM Vulnerability Lets Attackers Execute Malicious Commands – PoC Found in the Wild

A critical security vulnerability in the Fortinet FortiSIEM platform allows unauthenticated attackers to execute arbitrary commands remotely. The vulnerability CVE-2025-25256, classified as CWE-78 (OS ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)
  • Daily CyberSecurity
Chrome Stable Update 139 Blocks High-Severity Exploits in V8, libaom, and ANGLE

Google has rolled out a Stable Channel update for desktop users, bringing Chrome to version 139.0.7258.127/.128 for Windows and Mac, and 139.0.7258.127 for Linux. The update will reach users over the ... Read more

Published Date: Aug 13, 2025 (2 weeks, 6 days ago)

The following table lists the changes that have been made to the CVE-2025-25256 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Aug. 15, 2025

    Action Type Old Value New Value
    Added Reference https://github.com/watchtowrlabs/watchTowr-vs-FortiSIEM-CVE-2025-25256
    Added Reference https://labs.watchtowr.com/should-security-solutions-be-secure-maybe-were-all-wrong-fortinet-fortisiem-pre-auth-command-injection-cve-2025-25256/
  • Initial Analysis by [email protected]

    Aug. 13, 2025

    Action Type Old Value New Value
    Added CPE Configuration OR *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 5.4.0 up to (excluding) 6.7.10 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (excluding) 7.0.4 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.1.0 up to (excluding) 7.1.8 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.2.0 up to (excluding) 7.2.6 *cpe:2.3:a:fortinet:fortisiem:*:*:*:*:*:*:*:* versions from (including) 7.3.0 up to (excluding) 7.3.2
    Added Reference Type Fortinet, Inc.: https://fortiguard.fortinet.com/psirt/FG-IR-25-152 Types: Vendor Advisory
    Added Reference Type CVE: https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/ Types: Third Party Advisory
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Aug. 13, 2025

    Action Type Old Value New Value
    Added Reference https://www.theregister.com/2025/08/13/fortinet_discloses_critical_bug/
  • New CVE Received by [email protected]

    Aug. 12, 2025

    Action Type Old Value New Value
    Added Description An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-78
    Added Reference https://fortiguard.fortinet.com/psirt/FG-IR-25-152
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact