Fortinet FortiOS
CVE-2025-58903
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege FortiOS credentials
-
DeliveryAccess management API over network
-
ExploitSend specially crafted API request
-
ExecutionUnchecked return value triggers null pointer dereference
-
PersistHTTP daemon crashes
-
ImpactManagement interface temporarily unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Return value checking
|
| Exploitation Conditions | Exploitation requires an authenticated session with high-privilege credentials on the FortiOS management API (PR:H per CVSS vector). The vulnerable code path is triggered via a specially crafted HTTP API request. No non-default configuration is required beyond having API or web management access enabled, which is standard in FortiOS deployments. Limiting factors include: (1) the attacker must already possess high-privilege (admin-level) account credentials, (2) impact is limited to a temporary crash of the HTTP daemon with no code execution, data exfiltration, or persistent compromise possible via this vulnerability alone, and (3) the scope is unchanged (S:U), meaning the crash cannot cascade to other system components. |
| Impact | This vulnerability presents low real-world risk. CVSS 2.7 (Low) is supported by the attack vector breakdown: AV:N (network-reachable) is the only elevated signal, while AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L indicates no confidentiality or integrity impact, only limited availability impact, and critically requires high privileges (PR:H). The EPSS score of 0.06% at the 20th percentile corroborates that this is statistically unlikely to see opportunistic exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis. The practical threat is limited to insider threat scenarios or compromised high-privilege accounts - an attacker who already holds admin-level credentials on FortiOS has far more impactful options available. The Siemens cross-reference slightly broadens scope but does not change the fundamental risk calculus. This is a low-priority finding absent evidence of targeted exploitation. |
| Exploit ScenarioDerived | An attacker with high-privilege credentials on a FortiOS management interface sends a specially crafted API request designed to trigger the unchecked return value path in the HTTP daemon. The null pointer dereference causes the httpd process to crash, temporarily disrupting web-based management and API access until the daemon restarts. No public exploit code has been identified at time of analysis, and exploitation requires pre-existing authenticated high-privilege access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Authenticated denial-of-service in Fortinet FortiOS allows a high-privileged user to crash the HTTP daemon via a specially crafted API request. The root cause is an unchecked return value (CWE-252) that triggers a null pointer dereference in the HTTP daemon, resulting in a temporary service disruption. EPSS exploitation probability is 0.06% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, placing this as low operational priority despite network-reachable attack vector.
RemediationAI
For the FortiOS 7.4.x branch, upgrade to version 7.4.8 or later, which resolves this vulnerability per Fortinet PSIRT advisory FG-IR-25-653 (https://fortiguard.fortinet.com/psirt/FG-IR-25-653). The patched version for the FortiOS 7.6.x branch is not explicitly stated in available data - consult the vendor advisory directly for the confirmed fixed release in that branch. As a compensating control where immediate patching is not feasible, restrict administrative API access to trusted management networks using FortiOS trusted host configuration, reducing exposure to the network attack vector. Note that restricting API access may impact legitimate automation or monitoring workflows that rely on the REST API. Siemens-affected product owners should additionally consult SSA-864900 for platform-specific remediation guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the FortiOS REST API handler, where a return value from an internal function call is not validated before the returned pointer is dereferenced. CWE-252 (Unchecked Return Value) is the root cause class: the code assumes the called function succeeded and proceeds to use its output, but under adversarial input the function returns an error or null, leading to a null pointer dereference and process crash. The affected component is the HTTP daemon (httpd), which serves the FortiOS management API and web UI. Affected CPE is cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* covering the 7.4.x branch prior to 7.4.8 and the 7.6.x branch from 7.6.0 through 7.6.3. The Siemens advisory SSA-864900 indicates downstream impact on Siemens products that embed or interface with FortiOS, broadening the effective attack surface beyond pure Fortinet deployments.
Know when Fortios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Remote code execution in Fortinet FortiOS (6.4 through 7.6.3) and FortiSwitchManager (7.0.x/7.2.x) lets an attacker run
Path traversal vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows authenticated admi
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
GitHub PoC
Exploit-DB