Fortinet FortiOS
CVE-2025-58903
LOW
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specialy crafted request.
AnalysisAI
Authenticated denial-of-service in Fortinet FortiOS allows a high-privileged user to crash the HTTP daemon via a specially crafted API request. The root cause is an unchecked return value (CWE-252) that triggers a null pointer dereference in the HTTP daemon, resulting in a temporary service disruption. EPSS exploitation probability is 0.06% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, placing this as low operational priority despite network-reachable attack vector.
Technical ContextAI
The vulnerability resides in the FortiOS REST API handler, where a return value from an internal function call is not validated before the returned pointer is dereferenced. CWE-252 (Unchecked Return Value) is the root cause class: the code assumes the called function succeeded and proceeds to use its output, but under adversarial input the function returns an error or null, leading to a null pointer dereference and process crash. The affected component is the HTTP daemon (httpd), which serves the FortiOS management API and web UI. Affected CPE is cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* covering the 7.4.x branch prior to 7.4.8 and the 7.6.x branch from 7.6.0 through 7.6.3. The Siemens advisory SSA-864900 indicates downstream impact on Siemens products that embed or interface with FortiOS, broadening the effective attack surface beyond pure Fortinet deployments.
RemediationAI
For the FortiOS 7.4.x branch, upgrade to version 7.4.8 or later, which resolves this vulnerability per Fortinet PSIRT advisory FG-IR-25-653 (https://fortiguard.fortinet.com/psirt/FG-IR-25-653). The patched version for the FortiOS 7.6.x branch is not explicitly stated in available data - consult the vendor advisory directly for the confirmed fixed release in that branch. As a compensating control where immediate patching is not feasible, restrict administrative API access to trusted management networks using FortiOS trusted host configuration, reducing exposure to the network attack vector. Note that restricting API access may impact legitimate automation or monitoring workflows that rely on the REST API. Siemens-affected product owners should additionally consult SSA-864900 for platform-specific remediation guidance.
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote a
FortiOS and FortiProxy contain an authentication bypass allowing unauthenticated attackers with knowledge of upstream/do
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke
Arbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
Same weakness CWE-252 – Unchecked Return Value
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today