EUVD-2025-209453
GHSA-p356-3hpr-4rhh
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.4, FortiAnalyzer Cloud 7.4.0 through 7.4.8, FortiAnalyzer Cloud 7.2 all versions, FortiAnalyzer Cloud 7.0 all versions, FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.8, FortiManager 7.2 all versions, FortiManager 7.0 all versions, FortiManager Cloud 7.6.0 through 7.6.4, FortiManager Cloud 7.4.0 through 7.4.8, FortiManager Cloud 7.2 all versions, FortiManager Cloud 7.0 all versions may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API
AnalysisAI
SQL injection in Fortinet FortiAnalyzer and FortiManager versions 7.0-7.6 allows privileged authenticated attackers to execute unauthorized code or commands via the JSON RPC API. This affects both on-premises and cloud variants across multiple major version branches (7.0, 7.2, 7.4, 7.6). The vulnerability requires high-privilege authentication (CVSS PR:H) but is remotely exploitable with low attack complexity. No public exploit identified at time of analysis, though the network attack vector and code execution capability make this a priority for organizations running affected Fortinet management infrastructure.
Technical ContextAI
This vulnerability stems from CWE-89 (Improper Neutralization of Special Elements in SQL Command) in the JSON RPC API interface of FortiAnalyzer and FortiManager products. These are Fortinet's centralized logging/analytics and device management platforms respectively, used to administer enterprise Fortinet security infrastructure. The flaw allows SQL injection through crafted API requests, bypassing input validation controls. Affected products include FortiAnalyzer (CPE: cpe:2.3:a:fortinet:fortianalyzer), FortiManager (CPE: cpe:2.3:a:fortinet:fortimanager), and their cloud-hosted variants across four major version families. The JSON RPC API is a remote management interface typically exposed to administrative networks, making proper authentication enforcement critical. SQL injection in management platforms is particularly severe as these systems often have elevated database privileges and access to sensitive configuration data across managed devices.
Affected ProductsAI
Fortinet FortiAnalyzer versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, all versions of 7.2.x and 7.0.x branches. FortiAnalyzer Cloud versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, all versions of 7.2.x and 7.0.x branches. FortiManager versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, all versions of 7.2.x and 7.0.x branches. FortiManager Cloud versions 7.6.0 through 7.6.4, 7.4.0 through 7.4.8, all versions of 7.2.x and 7.0.x branches. ENISA EUVD records indicate specific ranges including FortiManager 7.6.0-7.6.3, FortiManager Cloud 7.6.2-7.6.4, FortiAnalyzer Cloud 7.6.2-7.6.3, and FortiAnalyzer 7.6.0-7.6.3. Full details available in Fortinet advisory FG-IR-26-111 at https://fortiguard.fortinet.com/psirt/FG-IR-26-111.
RemediationAI
Apply vendor-released patches according to Fortinet advisory FG-IR-26-111. Based on affected version data, organizations should upgrade to versions beyond 7.6.4 for 7.6 branch deployments, beyond 7.4.8 for 7.4 branch, and migrate away from unsupported 7.2 and 7.0 branches entirely. Consult the official Fortinet FortiGuard advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-111 for exact patched versions and upgrade paths specific to each product variant. As interim mitigations until patching, restrict JSON RPC API access to trusted administrative networks only using firewall rules, implement strict monitoring of API access logs for suspicious SQL patterns, enforce multi-factor authentication for all privileged accounts with API access, and apply principle of least privilege to limit high-privilege account distribution. Review administrative account activity logs for signs of unauthorized API usage during the vulnerability window.
Share
External POC / Exploit Code
Leaving vuln.today