FortiExtender CVE-2025-64153

Exploitation requires the attacker to already hold a high-privilege (administrative) authenticated session on the FortiExtender device (CVSS PR:H) and network reachability to its management/HTTP interface. The trigger is a specific crafted HTTP request to a feature that improperly neutralizes special shell characters (CWE-78). Limiting factors: (1) high-privilege authentication is mandatory, so only administrators or attackers who have already compromised admin credentials/sessions can exploit it; (2) the management interface must be network-accessible to the attacker - restricting admin access to trusted management networks substantially reduces exposure; (3) only FortiExtender firmware 7.6.0-7.6.3, 7.4.0-7.4.7, and all 7.2.x / 7.0.x builds are affected. No user interaction is required (UI:N).

This is a moderate-priority, authenticated-only command injection flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 HIGH) is internally consistent with the description: network-reachable via a specific HTTP request, low complexity, but requiring high privileges (PR:H), which strongly caps real-world risk since the attacker must already hold an administrative/high-privilege session on the FortiExtender management interface. EPSS is 1.71% (77th percentile) - elevated above the median but not indicative of mass exploitation, which aligns with the PR:H barrier. There is no CISA KEV listing and no POC referenced in the provided data, so there is no evidence of active exploitation or public exploit code. No SSVC decision data was supplied. The signals are therefore consistent rather than conflicting: a genuine post-authentication RCE on a network appliance (which matters for defense-in-depth and privilege-boundary integrity), but not a drop-everything internet-wide emergency given the authentication requirement. The practical risk is a privileged admin (or a credential-theft/session-hijack attacker who has already obtained admin access) escalating from configuration control to full OS command execution on the device.

An attacker who has already obtained high-privilege (administrative) access to a FortiExtender's management interface sends a crafted HTTP request to a vulnerable endpoint that fails to neutralize shell metacharacters, causing injected OS commands to run with the device's privileges. No public proof-of-concept is referenced in the provided data. Because CVSS specifies AV:N/AC:L, the request itself is simple and remotely deliverable once authenticated, making this a realistic privilege-boundary bypass for a compromised or malicious admin.