FortiVoice
CVE-2025-60024
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain privileged authenticated session
-
DeliverySend crafted HTTP/HTTPS request with traversal path
-
ExploitWrite arbitrary file outside intended directory
-
ExecutionOverwrite executable/config file
-
ImpactAchieve code execution and appliance compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session on the FortiVoice web management interface (HTTP/HTTPS), and the description specifically qualifies the attacker as 'privileged,' implying operator- or admin-level access rather than an ordinary user - a significant limiting factor despite the network attack vector. Affected builds are FortiVoice 7.2.0 through 7.2.2 and 7.0.0 through 7.0.7; deployments outside these ranges or with the management interface not exposed to the attacker are not reachable. No user interaction is required. The main limiter is the prerequisite privileged authentication, which prevents unauthenticated internet-wide exploitation. |
| Impact | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates a network-reachable, low-complexity flaw with full CIA impact, and arbitrary file write on an appliance realistically enables remote code execution and device compromise. However, there is meaningful tension between the vector's PR:L and the description's explicit 'privileged authenticated attacker' language, which points to PR:H (administrative/operator-level access) - this materially lowers real-world exploitability and should be verified against the Fortinet advisory FG-IR-25-812. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' On balance this is a serious flaw worth prompt patching on affected FortiVoice deployments, but not an emergency mass-exploitation candidate: it is gated behind authenticated (likely privileged) access rather than being unauthenticated and internet-spraying. No SSVC decision data was provided. |
| Exploit ScenarioDerived | An attacker who already holds authenticated (per the description, privileged) access to the FortiVoice management interface sends a crafted HTTP/HTTPS request whose parameter contains directory-traversal sequences, causing the application to write attacker-controlled content to an arbitrary filesystem path. By overwriting a script, configuration, or web-accessible file, the attacker escalates the file write into code execution and full appliance compromise. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Arbitrary file write via path traversal in the FortiVoice web management interface (FortiVoice 7.0.0 through 7.0.7 and 7.2.0 through 7.2.2) lets a privileged authenticated operator escape the intended directory and drop files anywhere on the appliance using crafted HTTP/HTTPS commands, which on an appliance realistically escalates to remote code execution and full device compromise. NVD rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while independent review revises the privilege prerequisite to PR:H because the description explicitly describes a privileged attacker holding a valid management session. There is no evidence of active exploitation (the CVE is not in CISA KEV) and no public exploit code was identified at time of analysis; the dominant limiting factor is the requirement for authenticated, privileged access to the FortiVoice administrative interface.
RemediationAI
Apply the fixed FortiVoice release identified in Fortinet PSIRT advisory FG-IR-25-812 (https://fortiguard.fortinet.com/psirt/FG-IR-25-812), which is the authoritative source for the exact patched build numbers for both the 7.0.x and 7.2.x branches; upgrade off the affected ranges (7.0.0-7.0.7 and 7.2.0-7.2.2) as soon as a maintenance window allows. The provided data does not include an independently confirmed fix version, so treat the vendor advisory as the single source of truth rather than assuming a specific release. Because the flaw requires a privileged, authenticated session on the management interface, the highest-value compensating controls are access controls around that interface: block HTTP/HTTPS administrative access from untrusted networks (WAN/Internet) and restrict it to a dedicated management VLAN or VPN, accepting the trade-off that remote administration must then be routed through those controlled paths. Further reduce blast radius by removing or downgrading dormant administrative and operator accounts and enforcing least privilege, with the trade-off that legitimate operators lose some convenience, and by monitoring and alerting on unexpected file writes or tampering in appliance configuration and scheduled-task locations, which detects exploitation attempts but does not prevent them. None of these compensating controls eliminate the write primitive itself - only patching does - so they should be considered temporary mitigations until the vendor fix is deployed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-22 improper limitation of a pathname to a restricted directory affecting Fortinet's FortiVoice unified communications appliance, specifically its HTTP/HTTPS management interface. The interface processes commands that carry file path parameters, and insufficient normalization/validation of pathname input (for example '../' sequences or absolute paths) allows a file write primitive to be redirected outside the intended restricted directory. The CPE entries (cpe:2.3:a:fortinet:fortivoice) confirm the affected product is FortiVoice; note that the supplied CPE strings use version wildcards and therefore do not themselves define the fix boundary - the authoritative version ranges are those in the description and in Fortinet PSIRT advisory FG-IR-25-812. Impact across confidentiality, integrity and availability is rated High: on a network appliance, arbitrary file write typically enables persistence or code execution by targeting startup scripts, scheduled jobs, configuration stores, or web-served directories, so the write primitive is materially more dangerous than the traversal label alone suggests. The scoring discrepancy between the NVD vector (PR:L) and the independent assessment (PR:H) reflects ambiguity in how the 'privileged authenticated attacker' prerequisite maps to the CVSS privilege metric; the independent assessment's PR:H reading should be treated as authoritative for exploitability discussions.
Know when Fortivoice gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states a 'privileged' attacker so PR:H over NVD's PR:L; network HTTP(S) vector, no UI, and arbitrary file write plausibly yields full C/I/A via code execution.
Primary rating from Vendor (fortinet).
CVSS VectorVendor: fortinet
DescriptionCVE.org
Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands
Executive ViewAI
FortiVoice appliances running versions 7.0.0 through 7.0.7 and 7.2.0 through 7.2.2 are affected by a high-severity arbitrary file write vulnerability that could allow a malicious authenticated administrator to fully compromise the device, potentially leading to remote code execution and unauthorized access to communications data. Organizations relying on these VoIP systems for business communications should prioritize risk assessment because a successful exploit could disrupt telephony services, expose sensitive conversations, and serve as a pivot point for further network intrusion. Since no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, interim mitigations are critical to reduce exposure.
Restrict management interface access to trusted IP ranges, enforce multi-factor authentication for all administrative accounts, enable logging and monitoring for suspicious file write activity, and segment FortiVoice appliances from critical network segments.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
More in Fortivoice
View allArbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 an
Privilege escalation via path traversal affects multiple Fortinet appliances - FortiWeb (6.4, 7.0, 7.2, 7.4.0-7.4.4, 7.6
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiV
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS versio
OS command injection in Fortinet FortiVoice allows an authenticated administrator to execute arbitrary operating-system
Authenticated attackers with administrative privileges can exploit a SQL injection flaw in Fortinet FortiVoice to execut
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allo
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEn
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS versi
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison we
GitHub PoC
Exploit-DB