CVE-2025-64447
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary operations on FortiWeb web application firewalls by sending crafted HTTP/HTTPS requests with forged cookies. Attackers need prior knowledge of the FortiWeb serial number to exploit this flaw. Affected systems include FortiWeb versions 7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.10, 7.6.0-7.6.5, and 8.0.0-8.0.1.
💻 Affected Systems
- Fortinet FortiWeb
📦 What is this software?
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
Fortiweb by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing remote code execution, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized administrative access to FortiWeb management interface leading to configuration changes, rule bypass, or denial of service.
If Mitigated
Limited impact if serial numbers are protected and network access is restricted, though risk remains for exposed systems.
🎯 Exploit Status
Exploitation requires knowledge of FortiWeb serial number, which may be obtainable through information disclosure or social engineering.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiWeb 8.0.2, 7.6.6, 7.4.11, 7.2.12, 7.0.12
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-945
Restart Required: Yes
Instructions:
1. Download appropriate firmware version from Fortinet support portal. 2. Backup current configuration. 3. Upload firmware via web interface or CLI. 4. Reboot device after installation.
🔧 Temporary Workarounds
Restrict Management Access
allLimit access to FortiWeb management interfaces to trusted IP addresses only.
config system interface
edit <interface_name>
set allowaccess https ssh
set trust-ip-1 <trusted_ip>/<mask>
end
Enable Certificate-Based Authentication
allRequire client certificates for administrative access to add authentication layer.
config system global
set admin-server-cert enable
set admin-https-redirect enable
end
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FortiWeb from untrusted networks
- Monitor for unusual authentication attempts and cookie manipulation in web logs
🔍 How to Verify
Check if Vulnerable:
Check FortiWeb firmware version via web interface (System > Dashboard) or CLI command 'get system status'Check Version:
get system status | grep VersionVerify Fix Applied:
Verify firmware version is 8.0.2, 7.6.6, 7.4.11, 7.2.12, or 7.0.12 using 'get system status' command📡 Detection & Monitoring
Log Indicators:
- Unusual cookie values in HTTP requests
- Authentication attempts with manipulated session data
- Requests containing serial number patterns
Network Indicators:
- HTTP/HTTPS requests with unusually crafted cookies to FortiWeb management ports
- Traffic patterns suggesting cookie tampering
SIEM Query:
source="fortiweb" AND (http_cookie="*serial*" OR http_cookie="*forged*")