FortiOS CVE-2025-58325

Exploitation requires the attacker to already hold a privileged, authenticated session on the FortiOS CLI (management plane) - consistent with CVSS PR:H - and to issue specific crafted CLI commands that the system improperly handles (CWE-684, incorrect provision of specified functionality), allowing escape to underlying OS command execution. Limiting factors: no remote network vector (AV:L), no unauthenticated path, and the need for high-privilege CLI access mean this is not exploitable against default remote-facing configurations by external unauthenticated attackers; realistic risk is confined to environments where lower-trust or additional users are granted administrative CLI access, or where a privileged account is compromised. Affected builds are FortiOS 7.6.0, 7.4.0-7.4.5, 7.2.5-7.2.10, 7.0.0-7.0.15, and all 6.4 versions.

This is a moderate-severity local privilege/command-execution issue, not an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N, score 6.7) confirms exploitation requires local access AND already-high privileges on the device, which sharply limits the attacker population - the primary concern is a privileged administrator breaking out of the restricted FortiOS CLI to run arbitrary system commands (C:H/I:H/A:H). All real-world exploitation signals point low: EPSS is 0.29% (19th percentile), the CVE is NOT in CISA KEV, and no public POC is referenced. The signals are consistent rather than conflicting - high technical impact but very constrained access (PR:H) correctly yields a Medium, not Critical, rating. Because PR:H means the attacker must already hold a privileged CLI account, the practical risk is an authorization/sandbox-escape concern (a lower-tier admin or compromised privileged account escalating to underlying OS command execution) rather than mass exploitation. This is a patch-in-normal-cycle item for most defenders, with higher priority only where untrusted or lower-trust users are granted CLI/admin access to FortiGate devices.

A FortiOS administrator with legitimate but restricted CLI access (or an attacker who has compromised such an account) issues specially crafted CLI commands that the system improperly handles, escaping the intended command sandbox to execute arbitrary commands on the underlying operating system. Because the CVSS vector is AV:L/AC:L/PR:H, this requires existing privileged local/management-plane access and is low-complexity once that access is held. No public exploit code has been identified at the time of analysis.