Fortinet FortiOS
CVE-2025-31366
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionNVD
An Improper Neutralization of Input During Web Page Generation vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions, FortiSASE 25.2.a may allow an unauthenticated attacker to perform a reflected cross site scripting (XSS) via crafted HTTP requests.
AnalysisAI
Reflected cross-site scripting (XSS) in FortiOS, FortiProxy, and FortiSASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by tricking them into clicking a crafted HTTP request link. The vulnerability spans a wide range of FortiOS versions from 6.4 through 7.6.3 and all FortiProxy 7.x branches, meaning a large installed base of Fortinet network security appliances is affected. A Siemens CERT advisory (SSA-864900) indicates this vulnerability also affects Siemens products that embed Fortinet components, broadening organizational impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize attacker-supplied input before it is reflected back in a dynamically generated web page. In this case, FortiOS, FortiProxy, and FortiSASE web management interfaces do not adequately encode or strip attacker-controlled content from HTTP responses, allowing injected JavaScript or HTML to execute in the victim's browser context. CPE strings confirm affected products: cpe:2.3:o:fortinet:fortios, cpe:2.3:a:fortinet:fortiproxy, and cpe:2.3:a:fortinet:fortisase (version 25.2.a and 25.3.40 in both feature and mature tracks). The CVSS Scope=Changed (S:C) designation confirms this is a cross-site context: the exploit's impact extends beyond the vulnerable server to the victim's browser session, which is characteristic of reflected XSS enabling session token theft, credential phishing, or unauthorized actions on behalf of the victim.
RemediationAI
Consult the Fortinet PSIRT advisory FG-IR-24-542 at https://fortiguard.fortinet.com/psirt/FG-IR-24-542 for the exact patched versions; the advisory is the authoritative source for fixed release numbers, which are not independently specified in the available data - citing invented version numbers is avoided here. Organizations running Siemens products that embed Fortinet components should additionally review Siemens CERT advisory SSA-864900 for Siemens-specific guidance and patch timelines, which may differ from Fortinet's direct-release schedule. As a compensating control where patching is delayed, restrict access to the FortiOS and FortiProxy web management interfaces to trusted, internal IP ranges only using administrative access control lists, reducing the population of users who could be targeted through social engineering. Additionally, enforce Content Security Policy (CSP) headers if your deployment supports custom response header injection upstream (e.g., via a WAF), which can limit the impact of script injection even if triggered. Note that these compensating controls reduce but do not eliminate risk - patching remains the only definitive remediation.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthor
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthor
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to exec
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today