CVE-2025-64446
📋 TL;DR
A relative path traversal vulnerability in Fortinet FortiWeb web application firewalls allows attackers to execute administrative commands via crafted HTTP/HTTPS requests. This affects FortiWeb versions 7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.9, 7.6.0-7.6.4, and 8.0.0-8.0.1.
💻 Affected Systems
- Fortinet FortiWeb
📦 What is this software?
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrative access, allowing attackers to modify configurations, exfiltrate data, or deploy ransomware.
Likely Case
Unauthorized administrative command execution leading to configuration changes, data access, or lateral movement within the network.
If Mitigated
Limited impact if proper network segmentation, access controls, and monitoring are in place to detect and block exploitation attempts.
🎯 Exploit Status
Public proof-of-concept code exists and CISA confirms active exploitation. Attack requires network access to FortiWeb management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiWeb 8.0.2, 7.6.5, 7.4.10, 7.2.12, 7.0.12
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-910
Restart Required: Yes
Instructions:
1. Download the appropriate firmware version from Fortinet support portal. 2. Backup current configuration. 3. Upload and install the firmware update via web interface or CLI. 4. Reboot the appliance. 5. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Management Interface Access
allLimit access to FortiWeb management interface to trusted IP addresses only.
config system interface
edit <interface_name>
set allowaccess https ssh
set trust-ip-1 <trusted_ip>/<mask>
end
Disable Unused Management Protocols
allDisable HTTP/HTTPS management access if not required, using SSH/console only.
config system interface
edit <interface_name>
set allowaccess ssh
unset allowaccess https http
end
🧯 If You Can't Patch
- Implement strict network access controls to limit FortiWeb management interface exposure.
- Deploy network intrusion detection rules to monitor for exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check FortiWeb firmware version via web interface (System > Dashboard) or CLI command 'get system status'.Check Version:
get system status | grep VersionVerify Fix Applied:
Verify firmware version is 8.0.2, 7.6.5, 7.4.10, 7.2.12, or 7.0.12 using 'get system status' command.📡 Detection & Monitoring
Log Indicators:
- Unusual administrative command execution logs
- Multiple failed authentication attempts followed by successful administrative actions
- HTTP requests with path traversal patterns (../ sequences)
Network Indicators:
- HTTP/HTTPS requests to FortiWeb management interface with unusual paths or parameters
- Traffic from unexpected source IPs to management ports
SIEM Query:
source="fortiweb" AND (url="*../*" OR action="execute" OR user="admin")