Fortinet FortiSandbox CVE-2025-54353

Exploitation requires the FortiSandbox administrative web interface to be reachable by the attacker-supplied request and, critically, an authenticated administrator or operator must be tricked into opening the attacker-crafted HTTP request or link (UI:R) for the reflected payload to execute in their browser. Limiting factors: the mandatory user-interaction step (no silent/automatable mass exploitation), impact confined to the victim's browser session rather than the appliance OS (Low C/I, no availability impact), and exposure depends on whether the management interface is internet-facing versus restricted to a trusted management network. No special non-default product feature toggle is named in the description - the flaw is in web page generation handling crafted HTTP requests.

This is a moderate-severity reflected cross-site scripting flaw (CVSS 6.1) in Fortinet FortiSandbox management interfaces. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity, unauthenticated triggering (PR:N) but mandatory user interaction (UI:R) - the victim must load an attacker-crafted request/link, which is the primary factor limiting mass exploitation. The scope change (S:C) and Low C/I impacts are consistent with script execution in the browser context rather than direct compromise of the appliance OS. Signals partially conflict: EPSS is elevated at 6.31% / 93rd percentile, which is high for a reflected XSS and suggests notable scanner/exploit interest, yet there is no CISA KEV listing and no public exploit identified, so the EPSS figure likely reflects the general attention Fortinet appliance CVEs attract rather than confirmed in-the-wild use. Net assessment: a credible but secondary priority - real risk exists against admins of exposed FortiSandbox web consoles, but the UI:R requirement and absence of KEV/POC place it below network-unauthenticated RCE-class Fortinet issues. Patch promptly as part of routine maintenance; the Fortinet PSIRT advisory FG-IR-25-477 is the authoritative source for fixed versions, which were not enumerated in the provided data.

An attacker crafts a malicious URL or HTTP request targeting the FortiSandbox web interface and lures an authenticated administrator into opening it (e.g., via phishing). When the admin's browser renders the unsanitized response, attacker-controlled JavaScript executes in the context of the FortiSandbox console, potentially stealing session tokens or performing actions as the admin. No public proof-of-concept exploit was identified at the time of analysis.