Fortinet FortiVoice
CVE-2025-47856
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged FortiVoice admin access
-
DeliverySend crafted HTTP/HTTPS or CLI request
-
ExploitInject OS commands via unsanitized parameter
-
ExecutionExecute arbitrary commands on appliance OS
-
ImpactFull host compromise and lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold privileged (administrative) access to the FortiVoice management interface, consistent with PR:H in the CVSS vector. Given that access, the attacker triggers the flaw by submitting crafted HTTP/HTTPS requests to the web management interface or crafted CLI requests. Affected deployments are FortiVoice 7.2.0, 7.0.0 through 7.0.6, and versions before 6.4.10. The primary limiting factor is the privileged-access prerequisite: this is a post-authentication issue, not a remote-unauthenticated one, so realistic risk is confined to scenarios where admin credentials are compromised, shared, or reachable on an exposed management interface. No end-user interaction is required (UI:N). |
| Impact | This is a genuine but second-tier priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 High) is self-consistent with the description: network-reachable via HTTP/HTTPS or CLI, low attack complexity, but gated behind PR:H - the attacker must already hold privileged (administrative) access to FortiVoice. The high privilege requirement is what caps the score below 9.0 and is the single most important mitigating factor. EPSS is 1.32% (70th percentile), which is modestly above median but low in absolute terms, consistent with a flaw that is not trivially mass-exploitable because of the privilege prerequisite. There is NO CISA KEV listing and NO public exploit code identified in the provided data, so this is not confirmed active exploitation. No SSVC decision data was supplied. Signals are consistent (no contradictions): network vector plus privileged-only access plus modest EPSS all point to a post-authentication RCE primitive useful for privilege consolidation (e.g., breaking from a constrained admin role to full OS command execution) rather than an internet-wide spray target. Treat as a prompt-patch item, especially where FortiVoice admin interfaces are internet-exposed, but it does not carry the drop-everything urgency of an unauthenticated KEV-listed RCE. |
| Exploit ScenarioDerived | An attacker who has already obtained privileged/administrative credentials to a FortiVoice appliance (via phishing, credential reuse, or a chained lower-privilege flaw) sends a crafted HTTP/HTTPS request or CLI command that injects OS commands into an improperly neutralized parameter. This yields arbitrary command execution on the underlying appliance OS, escalating from application-level admin to full host control. No public proof-of-concept exploit was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
OS command injection in Fortinet FortiVoice allows an authenticated administrator to execute arbitrary operating-system commands on the appliance by sending crafted HTTP/HTTPS requests to the management interface or crafted CLI commands. Affected deployments are FortiVoice 7.2.0, 7.0.0 through 7.0.6, and versions before 6.4.10, and because the CVSS vector carries PR:H, the attacker must already hold privileged (administrative) access, making this a post-authentication issue rather than an unauthenticated remote compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is modest at 1.32% (70th percentile), so this is a genuine but second-tier priority rather than an emergency, with the strongest risk driver being exposed or shared administrative credentials on the FortiVoice management interface.
RemediationAI
The provided data does not include an exact fixed firmware version, so the authoritative upgrade path must be taken from the Fortinet PSIRT advisory FG-IR-25-250 (https://fortiguard.fortinet.com/psirt/FG-IR-25-250), which covers FortiVoice 6.4.x, 7.0.x, and 7.2.x; consult it and move each affected appliance to the vendor-designated fixed build for its branch before relying on any other mitigation. Because exploitation requires an existing privileged account (PR:H), the highest-value compensating controls are credential and exposure hardening: remove FortiVoice management interfaces from direct internet exposure by restricting administrative HTTP/HTTPS and CLI/SSH access to trusted management networks or VPN only, with the trade-off that remote administration becomes dependent on the VPN or jump host being available; disable any WAN-facing administrative access on the appliance, accepting that out-of-band administration is then required; rotate and strengthen all administrator credentials and enable multi-factor authentication where supported, which does not fix the injection flaw but removes the compromised-credential precondition most likely to enable it; and segment the FortiVoice appliance so that even a successful command execution cannot reach broader management or directory infrastructure. As detective controls, forward FortiVoice administrative and system logs to a central SIEM and alert on unexpected shell-like characters, encoded payloads, or unusual process execution from the appliance, acknowledging that auditing generates volume that must be tuned to remain useful. No vendor-released patch version can be confirmed from the supplied data, and no workaround short of upgrading has been independently verified to close the injection paths.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-78, improper neutralization of special elements used in an OS command, meaning user-supplied input reaching a shell invocation is not properly escaped or validated before being passed to the underlying operating system. Fortinet reports two distinct improper-neutralization instances affecting FortiVoice, reachable either through the web-based management interface or through the device CLI, which indicates the vulnerable code path accepts attacker-controlled strings in a context where they are ultimately interpreted by a command shell running with the privileges of the FortiVoice service. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the management interface is network-reachable, the attack is low-complexity and requires no user interaction, but that high privileges are a hard prerequisite; scope is unchanged, so the attacker operates within the appliance's existing security context rather than escaping it. Consistent with this, successful exploitation yields full high-integrity impact across confidentiality, integrity, and availability of the appliance, which in practice means potential control of the FortiVoice system itself. CPE data enumerates Fortinet FortiVoice across multiple wildcarded version ranges plus the specific 7.2.0 release, aligning with the three affected branches described by the vendor.
Know when Fortivoice gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin interface (AV:N) with low complexity (AC:L); PR:H because a privileged account is required; command injection yields full OS-level C/I/A impact on an unchanged scope.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
DescriptionCVE.org
Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoice version 7.2.0, 7.0.0 through 7.0.6 and before 6.4.10 allows a privileged attacker to execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.
Executive ViewAI
A high-severity command injection flaw in Fortinet FortiVoice (7.2.0, 7.0.0-7.0.6, and versions before 6.4.10) lets someone who already holds administrative credentials run arbitrary operating-system commands on the voice appliance. Because exploitation requires privileged access, the realistic threat is insider misuse, stolen or shared admin credentials, or an attacker who has already compromised an administrator account - all of which can lead to full appliance takeover and potential lateral movement into the corporate network. Leadership should care because voice infrastructure often sits on the same network as other business systems, and no vendor patch is available yet, so risk must be managed through credential hygiene and network exposure reduction.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict management interface and CLI access to trusted networks or a dedicated management VLAN, enforce least privilege and rotate all administrative credentials (eliminating shared accounts), require multi-factor authentication for administrators, monitor and alert on administrative command execution, and consider network segmentation or decommissioning of any appliance that cannot be isolated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Fortivoice
View allArbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 an
Privilege escalation via path traversal affects multiple Fortinet appliances - FortiWeb (6.4, 7.0, 7.2, 7.4.0-7.4.4, 7.6
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiV
Arbitrary file write via path traversal in the FortiVoice web management interface (FortiVoice 7.0.0 through 7.0.7 and 7
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versio
Authenticated attackers with administrative privileges can exploit a SQL injection flaw in Fortinet FortiVoice to execut
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allo
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEn
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS versi
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison we
GitHub PoC
Exploit-DB